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Preface 


This preface introduces the ARM” Cortex®-A72 MPCore Processor Technical Reference Manual. 


It contains the following: 


e About this book on page 9. 
e Feedback on page 12. 
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Preface 
About this book 


About this book 


This document describes the ARM” Cortex®-A72 processor. 


Product revision status 


The rmpn identifier indicates the revision status of the product described in this book, for example, rip2, 
where: 

rm Identifies the major revision of the product, for example, r1. 

pn Identifies the minor revision or modification status of the product, for example, p2. 


Intended audience 


This document is written for system designers, system integrators, and programmers who are designing 
or programming a System-on-Chip (SoC) that uses the Cortex-A72 processor. 


Using this book 
This book is organized into the following chapters: 


Chapter 1 Introduction 
This chapter introduces the Cortex-A72 processor and its features. 


Chapter 2 Functional Description 
This chapter describes the functionality of the Cortex-A72 processor. 


Chapter 3 Programmers Model 
This chapter describes the processor registers and provides information for programming the 
processor. 


Chapter 4 System Control 
This chapter describes the System registers, their structure, operation, and how to use them. 


Chapter 5 Memory Management Unit 
This section describes the Memory Management Unit (MMU). 


Chapter 6 Level 1 Memory System 
This section describes the Level 1 (L1) memory system. 


Chapter 7 Level 2 Memory System 
This chapter describes the Level 2 (L2) memory system. 


Chapter 8 Generic Interrupt Controller CPU Interface 
This section describes the Cortex-A72 processor implementation of the GIC CPU interface. 


Chapter 9 Generic Timer 
This chapter describes the Cortex-A72 processor implementation of the ARM Generic Timer. 


Chapter 10 Debug 
This section describes the Cortex-A72 processor debug registers and shows examples of how to 
use them. 


Chapter 11 Performance Monitor Unit 
This section describes the Performance Monitor Unit (PMU) and the registers that it uses. 


Chapter 12 Cross Trigger 
This chapter describes the cross trigger interfaces for the Cortex-A72 processor. 


Chapter 13 Embedded Trace Macrocell 
This section describes the Embedded Trace Macrocell (ETM) for the Cortex-A72 processor. 


Chapter 14 Advanced SIMD and Floating-point 
This chapter describes the Advanced SIMD and Floating-point features and registers in the 
Cortex-A72 processor. 
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Appendix A Signal Descriptions 
This section describes the Cortex-A72 processor signals. 


Appendix B AArch32 Unpredictable Behaviors 
This appendix describes specific Cortex-A72 processor UNPREDICTABLE behaviors that are of 
particular interest. 


Appendix C Revisions 
This appendix describes the technical changes between released issues of this book. 


Glossary 


The ARM Glossary is a list of terms used in ARM documentation, together with definitions for those 
terms. The ARM Glossary does not contain terms that are industry standard unless the ARM meaning 
differs from the generally accepted meaning. 


See the ARM Glossary for more information. 


Typographic conventions 
italic 
Introduces special terminology, denotes cross-references, and citations. 
bold 
Highlights interface elements, such as menu names. Denotes signal names. Also used for terms 
in descriptive lists, where appropriate. 
monospace 
Denotes text that you can enter at the keyboard, such as commands, file and program names, 
and source code. 
monospace 
Denotes a permitted abbreviation for a command or option. You can enter the underlined text 
instead of the full command or option name. 
monospace italic 
Denotes arguments to monospace text where the argument is to be replaced by a specific value. 
monospace bold 
Denotes language keywords when used outside example code. 


<and> 
Encloses replaceable terms for assembler syntax where they appear in code or code fragments. 
For example: 
MRC p15, ©, <Rd>, <CRn>, <CRm>, <Opcode_2> 
SMALL CAPITALS 


Used in body text for a few terms that have specific technical meanings, that are defined in the 
ARM glossary. For example, IMPLEMENTATION DEFINED, IMPLEMENTATION SPECIFIC, UNKNOWN, and 
UNPREDICTABLE. 


Timing diagrams 


The following figure explains the components used in timing diagrams. Variations, when they occur, 
have clear labels. You must not assume any timing information that is not explicit in the diagrams. 


Shaded bus and signal areas are undefined, so the bus or signal can assume any value within the shaded 
area at that time. The actual level is unimportant and does not affect normal operation. 
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Bus stable 


Bus to high impedance J 
Bus change X} 
High impedance to stable bus ~ ¥ 


Figure 1 Key to timing diagram conventions 


Signals 
The signal conventions are: 


Signal level 
The level of an asserted signal depends on whether the signal is active-HIGH or active-LOW. 
Asserted means: 
¢ HIGH for active-HIGH signals. 
e LOW for active-LOW signals. 


Lowercase n 
At the start or end of a signal name denotes an active-LOW signal. 


Additional reading 


This book contains information that is specific to this product. See the following documents for other 
relevant information. 


ARM publications 
+ ARM” AMBA® APB Protocol Specification (ARM IHI 0024). 
e+ ARM” AMBA® 3 ATB Protocol Specification (ARM IHI 0032). 
+ ARM” AMBA” AXI and ACE Protocol Specification (ARM IHI 0022). 
+ ARM” AMBA” AXI4-Stream Protocol Specification (ARM IHI 0051). 
e ARM” Architecture Reference Manual ARMV8, for ARMV8-A architecture 
profile (ARM DDI 0487). 
+ ARM” CoreSight™ SoC-400 Technical Reference Manual (ARM DII 0480). 
+ ARM” Debug Interface Architecture Specification ADIV5.0 to ADIv5.2 (ARM IHI 0031). 
+ ARM” Embedded Trace Macrocell Architecture Specification, ETMv4 (ARM IHI 0064). 
e ARM” Generic Interrupt Controller Architecture Specification GICv3 (ARM IHI 0048). 


The following confidential books are only available to licensees: 

e ARM” CoreSight™ Architecture Specification (ARM IHI 0029). 

e ARM” AMBA” 5 CHI Protocol Specification (ARM IHI 0050). 

e ARM” Cortex-A72 MPCore Processor Configuration and Sign-off Guide (ARM 100098). 

+ ARM” Cortex-A72 MPCore Processor Integration Manual (ARM 100096). 

+ ARM” Cortex-A72 MPCore Processor Cryptography Extension Technical Reference 
Manual (ARM 100097). 


Other publications 
e ANSI/IEEE, IEEE Standard for Binary Floating-Point Arithmetic, Std 754-1985. 
e ANSI/IEEE, IEEE Standard for Floating-Point Arithmetic, Std 754-2008. 
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Feedback 


Feedback on this product 


If you have any comments or suggestions about this product, contact your supplier and give: 

e The product name. 

e The product revision or version. 

e An explanation with as much information as you can provide. Include symptoms and diagnostic 
procedures if appropriate. 


Feedback on content 


If you have comments on content then send an e-mail to errata@arm.com. Give: 


¢ The title ARM® Cortex®-A72 MPCore Processor Technical Reference Manual. 
e The number ARM 100095 _0003_05_ en. 

e Ifapplicable, the page number(s) to which your comments refer. 

e A concise explanation of your comments. 


ARM also welcomes general suggestions for additions and improvements. 
Note 


ARM tests the PDF only in Adobe Acrobat and Acrobat Reader, and cannot guarantee the quality of the 
represented document when used with any other PDF reader. 
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Chapter 1 
Introduction 


This chapter introduces the Cortex-A72 processor and its features. 


It contains the following sections: 


¢ 1.1 About the Cortex-A72 processor on page 1-14. 

e 1.2 Compliance on page 1-15. 

e 1.3 Features on page 1-17. 

e 1.4 Interfaces on page 1-18. 

e 1.5 Implementation options on page 1-19. 

e 1.6 Test features on page 1-20. 

¢ 1.7 Product documentation and design flow on page 1-21. 
¢ 1.8 Product revisions on page 1-23. 
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1.1 About the Cortex-A72 processor 


1 Introduction 


1.1 About the Cortex-A72 processor 


The Cortex-A72 processor is a high-performance, low-power processor that implements the ARMv8-A 
architecture. It has one to four cores in a single processor device with L1 and L2 cache subsystems. 


The following figure shows an example block diagram of a Cortex-A72 processor configuration with 
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Figure 1-1 Example Cortex-A72 processor configuration 


See 2.7.71 Components of the processor on page 2-26 for a description of the Cortex-A72 processor 
functional components. 
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1.2 Compliance 
The Cortex-A72 processor complies with, or implements, the specifications described in this section. 


This TRM complements architecture reference manuals, architecture specifications, protocol 
specifications, and relevant external standards. It does not duplicate information from these sources. 


This section contains the following subsections: 

e 1.2.1 ARM architecture on page 1-15. 

e 1.2.2 Advanced Microcontroller Bus Architecture (AMBA) on page 1-15. 
e 1.2.3 CHI architecture on page 1-15. 

¢ 1.2.4 Generic Interrupt Controller architecture on page 1-15. 

e 1.2.5 Generic Timer architecture on page 1-16. 

e 1.2.6 Debug architecture on page 1-16. 

¢ 1.2.7 Embedded Trace Macrocell architecture on page 1-16. 


1.2.1 ARM architecture 
The Cortex-A72 processor implements the ARMv8-A architecture. This includes: 


e Support for both AArch32 and AArch64 Execution states. 

e Support for all Exception levels, ELO, EL1, EL2, and EL3, in each Execution state. 
e The A32 instruction set, previously called the ARM instruction set. 

e The T32 instruction set, previously called the Thumb instruction set. 

e The A64 instruction set. 


The Cortex-A72 processor supports the following features: 

e Advanced Single Instruction Multiple Data (SIMD) operations. 
e Floating-point operations. 

e Optional Cryptography Extension. 


The Cortex-A72 processor does not support the T32EE (ThumbEE) instruction set. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for more 
information. 


1.2.2 Advanced Microcontroller Bus Architecture (AMBA) 
The Cortex-A72 processor complies with the: 


e AMBA 4 AXI Coherency Extensions (ACE) protocol if the processor memory interface implements 

an ACE bus interface. See the ARM® AMBA® AXI and ACE Protocol Specification. 

e AMBA 4 Advanced eXtensible Interface (AXI) protocol for the Accelerator Coherency Port (ACP) 

lave interface. See the ARM® AMBA” AXI and ACE Protocol Specification. 

e AMBA 3 Advanced Peripheral Bus (APB) protocol. See the ARM® AMBA” APB Protocol 
Specification. 

e AMBA 3 Advanced Trace Bus (ATB) protocol. See the ARM® AMBA” 3 ATB Protocol Specification. 


n 





1.2.3 CHI architecture 
The processor complies with the CHI architecture if the memory interface implements a CHI bus 
interface. 

1.2.4 Generic Interrupt Controller architecture 


The Cortex-A72 processor implements the ARM Generic Interrupt Controller (GIC) v3 architecture. 


The processor includes only the GIC CPU interface. See the ARM” Generic Interrupt Controller 
Architecture Specification, GICV3. 
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1.2.5 Generic Timer architecture 


The processor implements the ARM Generic Timer architecture. See the ARM® Architecture Reference 
Manual ARMv8 for more information. 


1.2.6 Debug architecture 


The processor implements version 8 of the ARM Debug architecture that complies with the CoreSight 
architecture. 


See the following for more information: 
+ ARM” CoreSight™ Architecture Specification. 
e+ ARM” Architecture Reference Manual ARMvé, for ARMv8-A architecture profile. 


1.2.7 Embedded Trace Macrocell architecture 
The processor implements the ETMV4 architecture. . 


See the . 
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1.3 Features 


The Cortex-A72 processor includes the following features: 


Full implementation of the ARMv8-A architecture profile. See /.2 Compliance on page 1-15. 
Superscalar, variable-length, out-of-order pipeline. 

Dynamic branch prediction with Branch Target Buffer (BTB) and Global History Buffer (GHB) 
RAMs, a return stack, and an indirect predictor. 

48-entry fully-associative L1 instruction Translation Lookaside Buffer (TLB) with native support for 
4KB, 64KB, and 1MB page sizes. 

32-entry fully-associative L1 data TLB with native support for 4KB, 64KB, and 1 MB page sizes. 
4-way set-associative unified 1024-entry Level 2 (L2) TLB in each processor. 

Fixed 48K L1 instruction cache and 32K L1 data cache. 

Shared L2 cache of 512KB, 1MB, 2MB or 4MB configurable size. 

Optional Error Correction Code (ECC) protection for L2 cache, and optional ECC protection for L1 
data cache and parity protection for L1 instruction cache. 

AMBA 4 AXI Coherency Extensions (ACE) or CHI master interface. 

Optional Accelerator Coherency Port (ACP) implemented as an AXI4 slave interface. 

Embedded Trace Macrocell (ETM) based on the ETMv4 architecture. 

Performance Monitor Unit (PMU) support based on the PMUV3 architecture. 

Cross Trigger Interface (CTI) for multiprocessor debugging. 

Optional Cryptography engine. 

Optional Generic Interrupt Controller (GIC) CPU interface. 

Support for power management with multiple power domains. 





Note 


The optional Cryptography engine is not included in the base product of the Cortex-A72 processor. ARM 
requires licensees to have contractual rights to obtain the Cortex-A72 processor Cryptography engine. 
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1.4 Interfaces 


1.4 Interfaces 
The Cortex-A72 processor has the following external interfaces: 


e Memory interface that implements either an ACE or CHI interface. 
e Optional ACP that implements an AXI slave interface. 

e Optional GIC CPU interface that implements an AX14-Stream interface 
e Debug interface that implements an APB slave interface. 

e Trace interface that implements an ATB interface. 

e PMU interface. 

e Generic Timer interface. 

e Cross trigger interface. 

e Power management interface. 

¢ Design For Test (DFT). 

e Memory Built-In Self Test (MBIST). 


See 2.2 Interfaces on page 2-29 for more information. 
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1 Introduction 
1.5 Implementation options 


1.5 Implementation options 


The following table lists the options that the implementer can choose when implementing the Cortex- 
A72 processor in an SoC. 


Table 1-1 Cortex-A72 processor implementation options 














Feature Range of options 
Number of cores 1-4 

Cryptography engine Included or Not 

L2 cache size 512KB, 1MB, 2MB, or 4MB 





L2 Tag RAM register slice 0 or 1 





L2 Data RAM register slice 0, 1, or 2 





L2 arbitration register slice 0 or 1 




















L2 FEQ size 20, 24, or 28 entries 

Regional gated clock ê Included or Not 

ECC or parity support Supported in L1 and L2, L2 only, or none. 
Bus interface ACE or CHI 

ACP Included or Not 

GIC CPU interface Included or Not 








Note 


e All the cores share an integrated L2 cache and optional GIC CPU interface. Each core has the same 
configuration for the Cryptography engine and L1 ECC or parity. 

¢ The optional Cryptography engine is not included in the base product of the Cortex-A72 processor. 
ARM requires licensees to have contractual rights to obtain the Cortex-A72 processor Cryptography 
engine. 

e The L2 Tag RAM register slice option adds register slices to the L2 Tag RAMs. The L2 Data RAM 
register slice option adds register slices to the L2 Data RAMs. The following table lists valid 
combinations of the L2 Tag RAM and L2 Data RAM register slice options. 


Table 1-2 Valid combinations of L2 Tag and Data RAM register slice 


L2 Tag RAM register slice L2 Data RAM register slice 

















0 0 
0 1 
1 1 
0 2 
1 2 





e Ifthe L2 arbitration register slice is included then it adds an additional pipeline stage in the 
processor-L2 arbitration logic interface. 
e The Cortex-A72 processor must be configured with a CHI interface to connect to a CHI interconnect. 








a See Regional clock gating on page 2-50 for more information. 
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1 Introduction 
1.6 Test features 


1.6 Test features 


The Cortex-A72 processor provides test signals that enable the use of both Automatic Test Pattern 
Generation (ATPG) and MBIST to test the processor and its memory arrays. 


See Appendix A Signal Descriptions on page Appx-A-529 for more information. 
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1.7 Product documentation and design flow 


1.7 Product documentation and design flow 


This section describes the Cortex-A72 processor books and how they relate to the design flow in 
documentation and design flow. 


See Additional reading on page 11 for more information about the books described in this section. For 
information on the relevant architectural standards and protocols, see 7.2 Compliance on page 1-15. 


This section contains the following subsections: 


e 1.7.1 Documentation on page 1-21. 
e 1.7.2 Design flow on page 1-22. 


1.7.1 Documentation 


The Cortex-A72 processor documentation is as follows: 


Technical Reference Manual 
The Technical Reference Manual (TRM) describes the functionality and the effects of functional 
options on the behavior of the processor. It is required at all stages of the design flow. The 
choices made in the design flow can mean that some behavior described in the TRM is not 
relevant. If you are programming the multiprocessor, additional information must be obtained 
from: 


The implementer to determine the build configuration of the implementation. 
The integrator to determine the pin configuration of the device that you are using. 





Note 


The out-of-order design of the Cortex-A72 processor pipeline makes it impossible to provide 
accurate timing information for complex instructions. The timing of an instruction can be 
affected by factors such as: 

— Other concurrent instructions. 

— Memory system activity. 

— Events outside the instruction flow. 

Timing information has been provided in the past for some ARM processors to assist in the 
hand tuning of performance critical code sequences or in the development of an instruction 
scheduler within a compiler. This timing information is not required for producing optimized 
instruction sequences on the Cortex-A72 processor. The out-of-order pipeline of the 
processor can schedule and execute the instructions in an optimal fashion without any 
instruction reordering required. 





Configuration and Sign-off Guide 
The Configuration and Sign-off Guide (CSG) describes: 


The available build configuration options and related issues in selecting them. 

How to configure the Register Transfer Level (RTL) source files with the build configuration 
options. 

How to integrate RAM arrays. 

How to run test vectors. 

The processes to sign off the configured design. 


The ARM product deliverables include reference scripts and information about using them to 
implement your design. Reference methodology flows supplied by ARM are example reference 
implementations. For EDA tool support, contact your EDA vendor. 


The CSG is a confidential book that is only available to licensees. 
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1 Introduction 
1.7 Product documentation and design flow 


Integration Manual 
The Jntegration Manual (IM) describes how to integrate the processor into an SoC. It describes 
the signals that the integrator must tie off to configure the macrocell for the required integration. 
Some of the implementation options might affect which integration options are available. 


The IM is a confidential book that is only available to licensees. 


1.7.2 Design flow 


The Cortex-A72 processor is delivered as synthesizable RTL. Before the processor can be used in a 
product, it must go through the following process: 


Implementation 
The implementer configures and synthesizes the RTL to produce a hard macrocell. This might 
include integrating the cache RAMs into the design. 
Integration 
The integrator connects the configured design into a SoC. This includes connecting it to a 
memory system and peripherals. 
Programming 
This is the last process. The system programmer develops the: 
e Software to configure the Cortex-A72 processor. 
e Software to initialize the Cortex-A72 processor. 
e Application software and the SoC tests. 


Each process: 


e Can be performed by a different party. 
e Can include implementation and integration choices that affect the behavior and features of the 
processor. 


The operation of the final device depends on: 


Build configuration 
The implementer chooses the options that affect how the RTL source files are preprocessed. 
These options usually include or exclude logic that can affect one or more of the area, maximum 
frequency, and features of the resulting macrocell. 

Configuration inputs 
The integrator configures some features of the processor by tying inputs to specific values. 
These configurations affect the start-up behavior before any software configuration is made. 
They can also limit the options available to the software. 

Software configuration 
The programmer configures the processor by programming particular values into registers. This 
affects the behavior of the processor. 


Note 


This manual refers to IMPLEMENTATION DEFINED features that apply to build configuration options. 
Reference to a feature that is included means that the appropriate build and signal configuration options 
have been selected. Reference to an enabled feature means that the feature has also been configured by 
software. 
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1.8 Product revisions 


1.8 Product revisions 
This section describes the differences in functionality between product revisions. 
r0p0 First release. 
r0p1 Adds support for 4MB L2 RAM. 
r0p2 Errata fixes. 
r0p3 Errata fixes. 


RTL change to improve performance of VA-based data prefetcher on some workloads. 
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Chapter 2 
Functional Description 


This chapter describes the functionality of the Cortex-A72 processor. 


It contains the following sections: 

¢ 2.1 About the Cortex-A72 processor functions on page 2-25. 
¢ 2.2 Interfaces on page 2-29. 

e 2.3 Clocking and resets on page 2-32. 

e 2.4 Power management on page 2-42. 
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2 Functional Description 
2.1 About the Cortex-A72 processor functions 


2.1 About the Cortex-A72 processor functions 


The following figure shows a top-level functional diagram of the Cortex-A72 processor. 
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Figure 2-1 Block diagram 


This section contains the following subsections: 
¢ 2.1.1 Components of the processor on page 2-26. 
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2 Functional Description 
2.1 About the Cortex-A72 processor functions 


2.1.1 Components of the processor 
The main components of the processor are: 


e Instruction fetch. 

e Instruction decode. 

e Instruction dispatch. 

e Integer execute. 

e Load/Store unit. 

e L2 memory system. 

e Advanced SIMD and Floating-point unit. 
e GIC CPU interface. 

e Generic Timer. 

e Debug and trace. 


Instruction fetch 


The instruction fetch unit fetches instructions from L1 instruction cache and delivers up to three 
instructions per cycle to the instruction decode unit. It supports dynamic and static branch prediction. 


The instruction fetch unit includes: 

e LI instruction cache that is a 48KB 3-way set-associative cache with a 64-byte cache line and 
optional dual-bit parity protection per 32 bits in the Data RAM and 36 bits in the Tag RAM. 

e 48-entry fully-associative L1 instruction Translation Lookaside Buffer (TLB) with native support for 
4KB, 64KB, and 1MB page sizes. 

e 2-level dynamic predictor with Branch Target Buffer (BTB) for fast target generation. 

e Static branch predictor. 

e Indirect predictor. 

e Return stack. 


Instruction decode 


The instruction decode unit decodes the following instruction sets: 


« A32. 
* 7132. 
« A64. 


The instruction decode unit supports the A32, T32, and A64 Advanced SIMD and Floating-point 
instruction sets. The instruction decode unit also performs register renaming to facilitate out-of-order 
execution by removing Write-After-Write (WAW) and Write-After-Read (WAR) hazards. 


Instruction dispatch 


The instruction dispatch unit controls when the decoded instructions are dispatched to the execution 
pipelines and when the returned results are retired. It includes: 


e The ARM core general-purpose registers. 
e The Advanced SIMD and Floating-point register set. 
e The AArch32 CP15 and AArch64 System registers. 


Integer execute 
The integer execute unit includes: 


e Two Arithmetic Logical Unit (ALU) pipelines. 

e Integer multiply-accumulate and ALU pipelines. 

e Iterative integer divide hardware. 

e Branch and instruction condition codes resolution logic. 
e Result forwarding and comparator logic. 
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2 Functional Description 
2.1 About the Cortex-A72 processor functions 


Load/Store unit 


The Load/Store (LS) execution unit executes load and store instructions and encompasses the L1 data 
side memory system. It also services memory coherency requests from the L2 memory system. 


The load/store unit includes: 

e LI data cache that is a 32KB 2-way set-associative cache with a 64-byte cache line and optional 
Error Correction Code (ECC) protection per 32 bits. 

e 32-entry fully-associative L1 data TLB with native support for 4KB, 64KB, and 1 MB page sizes. 

e Automatic hardware prefetcher that generates prefetches targeting the LID cache and the L2 cache. 


L2 memory system 


The L2 memory system services L1 instruction and data cache misses from each processor. It manages 
requests on the AMBA 4 AXI Coherency Extensions (ACE) or CHI master interface and the optional 
Accelerator Coherency Port (ACP) slave interface. 


The L2 memory system includes: 
e L2 cache that is: 
— 512KB, 1MB, 2MB, or 4MB configurable size. 
— 16-way set-associative cache with optional data ECC protection per 64 bits. 
e Duplicate copy of L1 data cache Tag RAMs from each processor for handling snoop requests. 
e 4-way set-associative of 1024-entry L2 TLB in each processor. 
e Automatic hardware prefetcher with programmable instruction fetch distance. 


Related information 
Chapter 7 Level 2 Memory System on page 7-298. 


Advanced SIMD and Floating-point unit 


The Advanced SIMD and Floating-point unit provides support for the ARMv8 Advanced SIMD and 
Floating-point execution. In addition, the Advanced SIMD and Floating-point unit provides support for 
the optional Cryptography engine. 





Note 


The optional Cryptography engine is not included in the base product of the Cortex-A72 processor. ARM 
requires licensees to have contractual rights to obtain the Cortex-A72 processor Cryptography engine. 


Related information 
Chapter 14 Advanced SIMD and Floating-point on page 14-511. 


GIC CPU interface 


The Generic Interrupt Controller (GIC) CPU interface delivers interrupts to the processor. 
Related information 
Chapter 8 Generic Interrupt Controller CPU Interface on page 8-318. 


Generic Timer 


The Generic Timer provides the ability to schedule events and trigger interrupts. 


Related information 
Chapter 9 Generic Timer on page 9-338. 


Debug and trace 


The debug and trace unit includes: 
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2 Functional Description 
2.1 About the Cortex-A72 processor functions 


Support for ARMv8 Debug architecture with an AMBA Advanced Peripheral Bus (APB) slave 
interface for access to the debug registers. 

Performance Monitor Unit (PMU) based on the PMUV3 architecture. 

Embedded Trace Macrocell (ETM) based on the ETMv4 architecture and an AMBA Advanced Trace 
Bus (ATB) interface for each processor. 

Cross trigger interfaces for core debugging. 


Related information 
Chapter 10 Debug on page 10-343. 
Chapter 11 Performance Monitor Unit on page 11-395. 


Chapter 12 Cross Trigger on page 12-434. 
Chapter 13 Embedded Trace Macrocell on page 13-457. 
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2 Functional Description 
2.2 Interfaces 


2.2 Interfaces 
This section describes the external interfaces within the Cortex-A72 processor. 


This section contains the following subsections: 

e 2.2.1 Memory interface on page 2-29. 

¢ 2.2.2 Optional Accelerator Coherency Port on page 2-29. 
e 2.2.3 Optional GIC CPU interface on page 2-29. 
e 2.2.4 Debug interface on page 2-29. 

e 2.2.5 Trace interface on page 2-30. 

e 2.2.6 PMU interface on page 2-30. 

e 2.2.7 Generic Timer interface on page 2-30. 

e 2.2.8 Cross trigger interface on page 2-30. 

e 2.2.9 Power management interface on page 2-30. 
e 2.2.10 DFT on page 2-30. 

e 2.2.11 MBIST on page 2-30. 


2.2.1 Memory interface 
The processor has a memory interface that implements either an AMBA 4 ACE or CHI bus interface: 


e ACE is an extension to the Advanced eXtensible Interface (AXI) protocol and provides the following 
enhancements: 


— Support for hardware cache coherency. 
— Barrier transactions that guarantee transaction ordering. 
— Distributed virtual memory messaging, enabling management of a virtual memory system. 


See the ARM® AMBA” AXI and ACE Protocol Specification for more information. 

e CHLis a protocol that provides an architecture for connecting multiple nodes using a scalable 
interconnect. The nodes on the interconnect might be cores, core clusters, I/O bridges, memory 
controllers, or graphics processors. See the ARM® AMBA® 5 CHI Protocol Specification. 


2.2.2 Optional Accelerator Coherency Port 


The processor implements an optional Accelerator Coherency Port (ACP). This isan AMBA 4 AXI 
slave interface. 


The ACP slave interface supports memory coherent accesses to the Cortex-A72 processor memory 
system, but cannot receive coherent requests, barriers, or distributed virtual memory messages. 


Related information 
10.10 External debug interface on page 10-381. 
AMBA AXI and ACE Protocol Specification. 
2.2.3 Optional GIC CPU interface 
The processor implements an optional GIC CPU interface with an AMBA AXI-4 Stream interface. 
See Chapter 8 Generic Interrupt Controller CPU Interface on page 8-318 for more information. 
2.2.4 Debug interface 
The Cortex-A72 processor implements an AMBA 3 APB slave interface that enables access to the debug 


registers. 


Related information 
10.10 External debug interface on page 10-381. 
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2.2.5 


2.2.6 


2.2.7 


2.2.8 


2.2.9 


2.2.10 


2.2.11 


2 Functional Description 
2.2 Interfaces 


Trace interface 


The processor implements dedicated AMBA 3 ATB interfaces for each core that outputs trace 
information for debugging. The ATB interface is compatible with the CoreSight architecture. 


Related information 
13.3 ETM functional description on page 13-461. 
PMU interface 


The processor implements Performance Monitors and provides an interrupt output and an event interface 
for each core. 


Related information 
Chapter 11 Performance Monitor Unit on page 11-395. 
Generic Timer interface 


The processor has a global timer input and each core has four timer interrupt outputs. 


Related information 
Chapter 9 Generic Timer on page 9-338. 


Cross trigger interface 


The processor implements a single cross trigger channel interface. This external interface is connected to 
the CoreSight Cross Trigger Interface (CTI) corresponding to each core through a simplified Cross 
Trigger Matrix (CTM). 


Related information 
Chapter 12 Cross Trigger on page 12-434. 


Power management interface 


The processor provides Q-channel interfaces that enable an external power controller to control the 
retention state of each core and the L2 RAMs. 


Related information 
Processor dynamic retention on page 2-46. 
L2 RAMs dynamic retention on page 2-48. 


DFT 


The processor implements a Design For Test (DFT) interface that enables an industry-standard 
Automatic Test Pattern Generation (ATPG) tool to test logic outside of the embedded memories. 


Related information 
A.16.1 DFT signals on page Appx-A-563. 
ARM Cortex-A72 MPCore Processor Integration Manual. 


MBIST 


The Memory Built-In Self Test (MBIST) interface provides support for manufacturing testing of the 
memories embedded in the Cortex-A72 processor. MBIST is the industry-standard method of testing 
embedded memories. MBIST works by performing sequences of reads and writes to the memory based 
on test algorithms. 
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2 Functional Description 





2.2 Interfaces 
Related information 
A.16 DFT and MBIST signals on page Appx-A-563. 
ARM Cortex-A72 MPCore Processor Integration Manual. 
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2.3 Clocking and resets 


2.3 Clocking and resets 
Clocks and resets used within the processor are described in this section. 


This section contains the following subsections: 
e 2.3.1 Clocks on page 2-32. 
e 2.3.2 Resets on page 2-36. 


2.3.1 Clocks 
The processor has the following clock inputs: 


CLK 
This is the main clock of the Cortex-A72 processor. All cores, the shared L2 memory system 
logic, the GIC, and the Generic Timer are clocked with a distributed version of CLK. 
PCLKDBG 
This is the APB clock that controls the Debug APB, CTI, and CTM logic in the PCLKDBG 
domain. PCLKDBG is asynchronous to CLK. 


The processor has the following clock enable inputs: 


ACLKENM 
The AXI master interface is a synchronous AXI interface that can operate at any integer 
multiple that is equal to or slower than the processor clock, CLK, using the ACLKENM signal. 
For example, you can set the CLK to ACLKM frequency ratio to 1:1, 2:1, or 3:1, where 
ACLKM is the AXI master clock. ACLKENM asserts one CLK cycle prior to the rising edge 
of ACLKM. The CLK to ACLKM frequency ratio can be changed dynamically using 
ACLKENM. 
The following figure shows a timing example of ACLKENM that changes the CLK to 
ACLKM frequency ratio from 3:1 to 1:1. 
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CLK:ACLKM = 1:1 
Figure 2-2 ACLKENM with CLK:ACLKM ratio changing from 3:1 to 1:1 


Note 


e The previous figure shows the timing relationship between the AXI master clock, ACLKM 
and ACLKENM, where ACLKENM asserts one CLK cycle before the rising edge of 
ACLKM. It is important that the relationship between ACLKM and ACLKENM is 











maintained. 
¢ The input signal ACLKENM exists in the processor if it is configured to include the ACE 
interface. 
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SCLKEN 
The CHI interface is a synchronous interface that can operate at any integer multiple that is 
equal to or slower than the processor clock, CLK, using the SCLKEN signal. For example, you 
can set the CLK to SCLK frequency ratio to 1:1, 2:1, or 3:1, where SCLK is the CHI clock. 
SCLKEN asserts one CLK cycle prior to the rising edge of SCLK. The CLK to SCLK 
frequency ratio can be changed dynamically using SCLKEN. 

The following figure shows a timing example of SCLKEN that changes the CLK to SCLK 
frequency ratio from 3:1 to 1:1. 


































































































cK! | | LI LJ | FARSHE 
SCLKEN J \ J 
ms SCLKEN is HIGH, one CLK cycle ea 
before the rising edge of SCLK 
SCLK 
+ CLK:SCLK = 3:1 >» +> 
CLK:SCLK = 1:1 
Figure 2-3 SCLKEN with CLK:SCLK ratio changing from 3:1 to 1:1 
Note 


e The previous figure shows the timing relationship between the CHI clock, SCLK and 
SCLKEN, where SCLKEN asserts one CLK cycle before the rising edge of SCLK. It is 
important that the relationship between SCLK and SCLKEN is maintained. 

¢ The input signal SCLKEN exists in the processor if it is configured to include the CHI 
interface. 





ACLKENS 
ACP is a synchronous AXI slave interface that can operate at any integer multiple that is equal 
to or slower than the processor clock, CLK, using the ACLKENS signal. For example, the 
CLK to ACLKS frequency ratio can be 1:1, 2:1, or 3:1, where ACLKS is the AXI slave clock. 
ACLKENS asserts one CLK cycle before the rising edge of ACLKS. The CLK to ACLKS 
frequency ratio can be changed dynamically using ACLKENS. 
The following figure shows a timing example of ACLKENS that changes the CLK to ACLKS 
frequency ratio from 3:1 to 1:1. 
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Figure 2-4 ACLKENS with CLK:ACLKS ratio changing from 3:1 to 1:1 


Note 


The previous figure shows the timing relationship between the ACP clock, ACLKS and 
ACLKENS, where ACLKENS asserts one CLK cycle before the rising edge of ACLKS. It is 
important that the relationship between ACLKS and ACLKENS is maintained. 











ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 2-33 
Non-Confidential 


2 Functional Description 
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PCLKENDBG 


The Debug APB interface is an asynchronous interface that can operate at any integer multiple 
that is equal to or slower than the APB clock, PCLKDBG, using the PCLKENDBG signal. For 
example, the PCLKDBG to internal PCLKDBG frequency ratio can be 1:1, 2:1, or 3:1. 
PCLKENDBG asserts one PCLKDBG cycle before the rising edge of the internal 
PCLKDBG. The PCLKDBG to internal PCLKDBG frequency ratio can be changed 
dynamically using PCLKENDBG. 


The following figure shows a timing example of PCLKENDBG that changes the PCLKDBG 
to internal PCLKDBG frequency ratio from 2:1 to 1:1. 
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Figure 2-5 PCLKENDBG with PCLKDBG: internal PCLKDBG ratio changing from 2:1 to 1:1 


ATCLKEN 


The ATB interface is a synchronous interface that can operate at any integer multiple that is 
slower than the processor clock, CLK, using the ATCLKEN signal. For example, the CLK to 
ATCLK frequency ratio can be 2:1, 3:1, or 4:1, where ATCLK is the ATB bus clock. 
ATCLKEN asserts three CLK cycles before the rising edge of ATCLK. Three CLK cycles are 
required to allow propagation delay from the ATCLKEN input to the processor. The CLK to 
ATCLK frequency ratio can be changed dynamically using ATCLKEN. 


The following figure shows a timing example of ATCLKEN where the CLK to ATCLK 
frequency ratio is 2:1. 
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Figure 2-6 ATCLKEN with CLK:ATCLK ratio at 2:1 
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CNTCLKEN 
The CNTVALUEB is a synchronous 64-bit binary encoded counter value that can operate at 
any integer multiple that is equal to or slower than the processor clock, CLK, using the 
CNTCLKEN signal. For example, you can set the CLK to CNTCLK frequency ratio to 1:1, 
2:1, or 3:1, where CNTCLK is the system counter clock. CNTCLKEN asserts one CLK cycle 
prior to the rising edge of CNTCLK. 


The following figure shows a timing example of CNTCLKEN where the CLK to CNTCLK 
frequency ratio is 2:1. 


2 Functional Description 
2.3 Clocking and resets 
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CNTCLKEN is HIGH, one CLK cycle 
before the rising edge of CNTCLK 












































CLKEN 
This is the clock enable for all internal clocks in the processor that are derived from CLK. The 
CLKEN signal must be asserted at least one cycle before applying CLK to the processor. 








¢—__—— 
CLK:CNTCLK = 2:1 





Figure 2-7 CNTCLKEN with CLK:CNTCLK ratio at 2:1 


When all the cores and L2 are in WFI low-power state, you can place the processor in a low- 
power state using the CLKEN input. Setting CLKEN LOW disables all of the internal clocks, 
excluding the asynchronous Debug APB PCLKDBG domain. 


Related information 
L2 Wait for Interrupt on page 2-44. 
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2.3.2 Resets 


The Cortex-A72 processor has the following reset inputs: 


nCPUPORESET|[N:0] 
Initializes the entire core logic, including Debug, ETM, breakpoint and watchpoint logic in the 
processor CLK domain. Each core has one nhCPUPORESET reset input. 
nCORERESET|[N:0] 
Initializes the entire core but excludes the Debug, ETM, breakpoint and watchpoint logic. Each 
core has one nCORERESET reset input. 
nPRESETDBG 
Initializes the shared Debug APB, CTI, and CTM logic in the PCLKDBG domain. 
nL2RESET 
Initializes the shared L2 memory system, GIC, and Timer logic. 
nMBISTRESET 
Performs an MBIST mode reset. 


All resets are active-LOW inputs. The reset signals enable you to reset different areas of the processor 
independently. The following table shows the areas of the processor controlled by the various reset 
signals. 


Table 2-1 Areas that the reset signals control 


























Reset signal Core? (CLK) Debug and Debug APB, CTI, and L2 memory system, Individual processor 
ETM (CLK) CTM (PCLKDBG) shared GIC and GIC and Timer logic 
Timer logic 
nCPUPORESET Reset Reset - - Reset 
nCORERESET Reset - - - Reset 
nPRESETDBG- - - Reset - - 
nL2RESET - - - Reset Reset 
The following table shows the valid reset combinations the processor supports. The core which is being 
reset is indicated by [n]. 
Table 2-2 Valid reset combinations 
Reset combination Signals Value Description 
Full powerup reset for the nCPUPORESET[N:0] all=0 All logic is held in reset. 
processor 


nCORERESET[N:0] all =0 


nPRESETDBG 0 
nL2RESET 0 
nMBISTRESET 1 





Individual core powerup reset nCPUPORESET[N:0] [n]=0 Individual core in the CLK domain and Debug in the PCLKDBG 


with Debug (PCLKDBG) 


reset 


c domain are held in reset, so that the core and Debug PCLKDBG 


nCORERESET[N:0] _ [n] =0 
domain can be powered up. 


nPRESETDBG 0 
nL2RESET 1 
nMBISTRESET 1 








b 


Core logic, excluding Debug, ETM, breakpoint, and watchpoint logic. 


© For powerup reset or core reset, nhCPUPORESET must be asserted. nCORERESET can be asserted, but is not required. 
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Table 2-2 Valid reset combinations (continued) 


























Reset combination Signals Value Description 
All core and L2 reset with nCPUPORESET[N:0] all=0 All cores and L2 are held in reset, so they can be powered up. This 
Debug (PCLKDBG) active nCORERESETIN:0] all = 0° enables external debug over powerdown for all cores. 
nPRESETDBG 1 
nL2RESET 0 
nMBISTRESET 1 
Individual core powerup reset nCPUPORESET[N:0] [n]=0 Individual core is held in reset, so that the core can be powered up. 
with Debug (PCLKDBG) nCORERESETIN:0] [n] = 0° This enables external debug over powerdown for the processor that 
active is held in reset. 
nPRESETDBG 1 
nL2RESET 1 
nMBISTRESET 1 
All cores Warm reset nCPUPORESET[N:0] all=1 All logic, excluding Debug and ETM (CLK and PCLKDBG) and 
nCORERESET[N:0] all =0 L2, is held in reset. All breakpoints and watchpoints are retained. 
nPRESETDBG 1 
nL2RESET 1 
nMBISTRESET 1 
All cores Warm reset and L2 nCPUPORESET[N:0] all=1 All logic, excluding Debug and ETM (CLK and PCLKDBG), is 
reset nCORERESETIN:0] all = 0 held in reset. All breakpoints and watchpoints are retained. 
nPRESETDBG 1 
nL2RESET 0 
nMBISTRESET 1 
Individual core Warm reset nCPUPORESET[N:0] [n]=1 Individual core logic, excluding the ETM and Debug in the CLK 
nCORERESET[N:0] [n] = 0 ins ie in reset. Breakpoints and watchpoints for that core 
nPRESETDBG 1 
nL2RESET 1 
nMBISTRESET 1 
Debug (PCLKDBG) reset nCPUPORESET[N:0] all=1 Debug in the PCLKDBG domain is held in reset, so that the 
nCORERESET|N:0] all = 1 Debug PCLKDBG domain can be powered up. 
nPRESETDBG 0 
nL2RESET 1 
nMBISTRESET 1 
Run mode nCPUPORESET[N:0] 1 No logic is held in reset. 


nCORERESET[N:0] 
nPRESETDBG 
nL2RESET 
nMBISTRESET 
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Note 


e nL2RESET resets the shared L2 memory system logic, GIC, and Generic Timer that is common to 
all cores. This reset must not assert while any individual processor is active. 

e nPRESETDBG resets the shared Debug, PCLKDBG, that is common to all cores. This reset must 
not assert while any individual core is actively being debugged in normal operating mode or during 
external debug over powerdown. 





There are specific requirements that you must meet to reset each reset area listed in Table 2-1 Areas that 
the reset signals control on page 2-36. Not adhering to these requirements can lead to a reset area that is 
not functional. 


The reset sequences in the following sections are the only reset sequences that ARM recommends. Any 
deviation from these sequences might cause an improper reset of that reset domain. The supported reset 
sequences are: 

e Powerup reset on page 2-38. 

* Warm reset on page 2-39, 

e Debug PCLKDBG reset on page 2-39. 

e WARMRSTREQ and DBGRSTREQ on page 2-40. 

e Memory arrays reset on page 2-40. 


Powerup reset 


Powerup reset is also known as Cold reset. This section describes the sequence for: 


e A full powerup reset. 
e An individual core powerup reset. 


The full powerup reset initializes all logic in the processor. You must apply powerup reset to the 
processor when power is first applied to the SoC. Logic in all clock domains are placed in a benign state 
following the deassertion of the reset sequence. 


The following figure shows the full powerup reset sequence for the Cortex-A72 processor. 
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Figure 2-8 Powerup reset timing 





nL2RESET «—____1___16 CLK cycles minimum» f 
WY 











nPRESETDBG<« 16 PCLKDBG cycles minimum 





On full powerup reset for the processor, perform the following reset sequence: 


1. Apply nCPUPORESET, nL2RESET, and nPRESETDBG. The remaining core reset, 
nCORERESET can assert, but is not required. 

2. nCPUPORESET and nL2RESET must assert for at least 16 CLK cycles. nPRESETDBG must 
assert for at least 16 PCLKDBG cycles. Holding the resets for this duration ensures that the resets 
propagate to all locations within the processor. 

3. nL2RESET must deassert in the same cycle as the core resets, or before any of the core resets 
deassert. 


Individual core powerup reset initializes all logic in a single core. You must apply the powerup reset 
when the individual core is being powered up, so that power to the core can be safely applied. You must 
apply the correct sequence before applying a powerup reset to that core. 
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For individual core powerup reset: 

e nCPUPORESET for that core must assert for at least 16 CLK cycles. 

e nL2RESET must not assert while any individual core is active. 

e nPRESETDBG must not assert while any individual core is actively being debugged in normal 
operating mode or during external debug over powerdown. 


Note 


If core dynamic retention using the CPU Q-channel interface is used, the core must be in quiescent state 
with STANDBYWFI asserted and CPUQREQn, CPUQACCEPTn, and CPUQACCEPT must be 
LOW before nCPUPORESET is applied. 








Warm reset 


The Warm reset initializes all logic in the individual core apart from the Debug and ETM logic in the 
CLK domain. All breakpoints and watchpoints are retained during a Warm reset sequence. 


The following figure shows the Warm reset sequence for the Cortex-A72 processor. 
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Figure 2-9 Warm reset timing 


Individual core Warm reset initializes all logic in a single core apart from its Debug, ETM, breakpoint, 
and watchpoint logic. Breakpoints and watchpoints for that core are retained. You must apply the correct 
sequence before applying Warm reset to that core. 


For individual processor Warm reset: 

e You must apply steps / on page 2-53 to /2 on page 2-53 in the core powerdown sequence, see 
Individual core powerdown on page 2-52, and wait until STANDBYWFEFI is asserted, indicating that 
the core is idle, before asserting nCORERESET for that core. 

e nCORERESET for that core must assert for at least 16 CLK cycles. 

e nL2RESET must not assert while any individual core is active. 

e nPRESETDBG must not assert while any individual core is actively being debugged in normal 
operating mode. 


Note 


If core dynamic retention using the CPU Q-channel interface is used, the core must be in quiescent state 
with STANDBYWFI asserted and CPUQREQn, CPUQACCEPTn, and CPUQACCEPT must be 
LOW before nCORERESET is applied. 








Debug PCLKDBG reset 


Use nPRESETDBG to reset the Debug APB, CTI, and CTM logic in the PCLKDBG domain. This 
reset holds the Debug PCLKDBG unit in a reset state so that the power to the unit can be safely applied 
during powerup. 
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To safely reset the Debug PCLKDBG unit, nPRESETDBG must assert for a minimum of 16 
PCLKDBG cycles. 


The following figure shows the Debug PCLKDBG reset sequence. 
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Figure 2-10 Debug PCLKDBG reset timing 





WARMRSTREQ and DBGRSTREQ 


The ARMv8-A architecture provides a mechanism to configure whether a processor uses AArch32 or 
AArch64 at EL3 as a result of a Warm reset. When the Reset Request bit in the RMR or RMR_EL3 
register is set to 1, the processor asserts the WARMRSTREQ signal and the SoC reset controller can use 
this request to trigger a Warm reset of the core and change the register width state. The AA64 bit in the 
RMR or RMR _EL3 register selects the register width at the next Warm reset, at the highest Exception 
level, EL3. 


See the ARM® Architecture Reference Manual ARMV8, for ARMvs8-A architecture profile for information 
about the recommended code sequence to use, to request a Warm reset. 


You must apply steps / on page 2-53 to /2 on page 2-53 in the core powerdown sequence, and wait 
until STANDBYWFI asserts indicating the processor is idle, before asserting nCORERESET for that 
core. nNCORERESET must satisfy the timing requirements described in the Warm reset section. 


The Core Warm Reset Request (CWRR) bit in the External Debug Power/Reset Control Register, 
EDPRCR, controls the DBGRSTREQ signal. An external debugger can use this bit to request a Warm 
reset of the processor, if it does not have access to the core Warm reset signal. See the ARM® Architecture 
Reference Manual ARMV8, for ARMv8-A architecture profile for more information about the EDPRCR. 


Related information 

4.3.61 Reset Management Register, EL3 on page 4-175. 
Individual core powerdown. 

Warm reset on page 2-39. 


Memory arrays reset 


During a core reset, the following memory arrays in the core are invalidated: 


e Branch Prediction arrays such as BTB, GHB, and Indirect Predictor. 
¢ LI instruction and data TLBs. 

¢ LI instruction and data caches. 

¢ L2 unified TLB. 


In addition to these core memory arrays, during a powerup reset, the following shareable memory arrays 
are invalidated: 


e L2 duplicate Snoop Tag RAM. 
¢ L2 unified cache RAM, if LARSTDISABLE is tied LOW. 


The L1 instruction and data cache resets can take up to 128 CLK cycles after the deasserting edge of the 
reset signals, with each array being reset in parallel. Depending on the size of the L2 cache, the L2 cache 
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reset can take 640 CLK cycles for a 512KB L2 cache or 5120 CLK cycles for a 4MB L2 cache. The L2 
cache reset occurs in the background, in parallel with the L1 cache resets. The core can begin execution 
in Non-cacheable state, but any attempt to perform Cacheable transactions stalls the core until the 
appropriate cache reset is complete. 


The branch prediction arrays require 512 CLK cycles to reset after the deasserting edge of reset. The 
core begins execution with branch prediction disabled, any resolved branches do not update the branch 
predictor until the reset sequence completes. 


The processor input signal, LARSTDISABLE, controls the L2 cache hardware reset process. The usage 

models for the LARSTDISABLE signal are as follows: 

e When the processor powers up for the first time, LARSTDISABLE must be held LOW to invalidate 
the L2 cache using the L2 cache hardware reset mechanism. 

e For systems that do not retain the L2 cache RAM contents while the L2 memory system is powered 
down, L2RSTDISABLE must be held LOW to invalidate the L2 cache using the L2 cache hardware 
reset mechanism. 

¢ For systems that retain the L2 cache RAM contents while the L2 memory system is powered down, 
L2RSTDISABLE must be held HIGH to disable the L2 cache hardware reset mechanism. 


The L2ZRSTDISABLE signal is sampled during nL2RESET assertion and must be held a minimum of 
32 CLK cycles after the deasserting edge of nL2RESET. 
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2.4 Power management 


The Cortex-A72 processor provides mechanisms and support to control both dynamic and static power 
dissipation. 


This section contains the following subsections: 

e 2.4.1 Dynamic power management on page 2-42. 

e 2.4.2 Power domains on page 2-51. 

e 2.4.3 Power modes on page 2-52. 

e 2.4.4 Using SMPEN as a power mode indicator on page 2-57. 


2.4.1 Dynamic power management 
This section describes the following dynamic power management features in the processor: 


e Core Wait for Interrupt on page 2-42. 

e Core Wait for Event on page 2-43. 

¢ Event communication using WFE and SEV instructions on page 2-43. 
e CLREXMON request and acknowledge signaling on page 2-43. 
e L2 Wait for Interrupt on page 2-44. 

e L2 hardware cache flush on page 2-45. 

e Processor dynamic retention on page 2-46. 

e L2 RAMs dynamic retention on page 2-48. 

¢ Advanced SIMD and FP clock gating on page 2-49. 

e L2 control and tag banks clock gating on page 2-49. 

e Regional clock gating on page 2-50. 


Core Wait for Interrupt 


Wait for Interrupt (WFI) is a feature of the ARMv8-A architecture that puts the core in a low-power state 
by disabling the clocks in the core while keeping the core powered up. This reduces the power drawn to 
the static leakage when the core is in WFI low-power state. 


A core enters into WFI low-power state by executing the WFI instruction. 


When executing the WFI instruction, the core waits for all instructions in the core to retire before entering 
the idle or low-power state. The WFI instruction ensures that all explicit memory accesses occurred 
before the WFI instruction in program order, have retired. For example, the WFI instruction ensures that 
the following instructions receive the required data or responses from the L2 memory system: 


e Load instructions. 
e Cache and TLB maintenance operations. 
e Store-Exclusive instructions. 


In addition, the WFI instruction ensures that store instructions update the cache or are issued to the L2 
memory system. 


While the core is in WFI low-power state, the clocks in the core are temporarily enabled without causing 

the core to exit WFI low-power state, when any of the following events are detected: 

e AnL2 snoop request that must be serviced by the core L1 data cache. 

e A cache, TLB, or BTB maintenance operation that must be serviced by the core L1 instruction cache, 
data cache, instruction TLB, data TLB, or BTB. 

e An APB access to the debug or trace registers residing in the core power domain. 


The core exits from WFI low-power state when it detects a reset or a WFI wake-up event occurs. See the 
ARM” Architecture Reference Manual ARMvV6, for ARMv8-A architecture profile for information about 
the various WFI wake-up events. 


On entry into WFI low-power state, STANDBYWFI for that core is asserted. STANDBYWFI continues 
to assert even if the clocks in the core are temporarily enabled because of an L2 snoop request, cache, 
TLB, and BTB maintenance operation or an APB access. 
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Core Wait for Event 


Wait for Event (WFE) is a feature of the ARMv8-A architecture that uses a locking mechanism based on 
events to put the core in a low-power state by disabling the clocks in the core while keeping the core 
powered up. This reduces the power drawn to the static leakage current, when the core is in WFE low- 
power state. 


A core enters into WFE low-power state by executing the WFE instruction. When executing the WFE 
instruction, the core waits for all instructions in the core to complete before entering the idle or low- 
power state. The WFE instruction ensures that all explicit memory accesses occurred before the WFE 
instruction in program order, have completed. 


While the core is in WFE low-power state, the clocks in the core are temporarily enabled without causing 
the core to exit WFE low-power state, when any of the following events are detected: 


e An L2 snoop request that must be serviced by the core L1 data cache. 

e A cache, TLB, or BTB maintenance operation that must be serviced by the core L1 instruction cache, 
data cache, instruction TLB, data TLB, or BTB. 

e An APB access to the debug or trace registers residing in the core power domain. 


The cores exits from WFE low-power state when: 

e It detects a reset. 

e The EVENTI input signal asserts. 

e The CLREXMONREQ input signal asserts. 

e A WFE wake-up event occurs. See the ARM® Architecture Reference Manual ARMVv8, for ARMv8-A 
architecture profile for information about the various WFE wake-up events. 


On entry into WFE low-power state, STANDBYWFE for that core is asserted. STANDBYWFE 
continues to assert even if the clocks in the core are temporarily enabled because of an L2 snoop request, 
cache, TLB, and BTB maintenance operation or an APB access. 


Event communication using WFE and SEV instructions 


The EVENTI signal enables an external agent to participate in the WFE and SEV event communication. 

When this signal is asserted, it sends an event message to all the cores in the processor. This is similar to 

executing an SEV instruction on one core in the processor. This enables the external agent to signal to the 

core that it has released a semaphore and that the core can leave the WFE low-power state. The EVENTI 
input signal must remain HIGH for at least one CLK cycle to be visible by the cores. 


The external agent can determine that at least one of the cores in the processor has executed an SEV 
instruction by checking the EVENTO signal. When any of the cores in the processor executes an SEV 
instruction, an event is signaled to all the cores in the processor, and the EVENTO signal is asserted. 
This signal is asserted HIGH for three CLK cycles when any of the cores executes an SEV instruction. 


CLREXMON request and acknowledge signaling 


The CLREXMONREQ signal has a corresponding CLREXMONACK response signal. This forms a 
standard 2-wire, 4-phase handshake that can be used to signal across the voltage and frequency boundary 
between the core and system. 


When the CLREXMONREQ input is asserted, it signals the clearing of an external global exclusive 
monitor and acts as WFE wake-up event to all the cores in the processor. 


The following figure shows the CLREXMON request and acknowledge handshake. When the request 
signal is asserted, it continues to assert until an acknowledge is received. When the request is deasserted, 
the acknowledge can then deassert. 


Note 
If a global exclusive monitor does not exist in your system, tie the CLREXMONREQ input LOW. 
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CLREXMONREQ 
CLREXMONACK 


Figure 2-11 CLREXMON request and acknowledge handshake 





L2 Wait for Interrupt 


When all the cores are in WFI low-power state, the shared L2 memory system logic that is common to all 
the cores can also enter a WFI low-power state. 


Entry into L2 WFI low-power state can only occur if specific requirements are met and the following 
sequence applied: 


1. All cores are in the WFI low-power state, so all the core STANDBYWFI outputs are asserted. 

2. When ACP is present and all outstanding ACP requests are complete, the SoC asserts the AINACTS 
input to idle the ACP slave interface. When AINACTS has been asserted, the SoC must not assert 
ARVALIDS, AWVALIDS, or WVALIDS. 

3. Ifthe processor implements: 


An ACE interface 
When all outstanding snoop requests are complete, the SoC asserts the ACINACTM input 
signal to idle the AXI master snoop interface. This prevents the L2 memory system from 
accepting any new requests from the AXI master snoop interface. When ACINACTM has 
been asserted, the SoC must not assert ACVALIDM. 

A CHI interface 
When all outstanding snoop requests are complete, the SoC asserts the SINACT input signal 
indicating that the processor is removed from the coherency domain and does not receive 
any more snoops. This triggers the L2 to deactivate the TX and RX links. When the TX and 
RX links are in their respective stop states, the L2 memory system does not accept any new 
requests from the CHI interface. 

4. When the L2 memory system completes the outstanding transactions for ACE and CHI interfaces, it 
can then enter the L2 WFI low-power state. On entry into L2 WFI low-power state, 
STANDBYWFIL2 is asserted. Assertion of STANDBYWFIL2 guarantees that the L2 is idle and 
does not accept any new transactions. 

5. The SoC can then choose to deassert the CLKEN input to the processor to stop all remaining internal 
clocks within the core that are derived from CLK. All clocks in the shared L2 memory system logic, 
GIC, and Timer, are disabled. 


If CLKEN is deasserted, the SoC must assert the CLKEN input on a WFI wake-up event to enable the 
L2 memory system and potentially the core. There are two classes of wake-up events: 


e An event that requires only the L2 memory system to be enabled. 
e An event that requires both the L2 memory and the core to be enabled. 


The following wake-up events cause both the L2 memory system and the core to exit WFI low-power 
state: 

e A physical IRQ or FIQ interrupt. 

e A debug event. 

e Powerup or Warm reset. 


The following wake-up events cause only the L2 memory system to exit WFI low-power state: 

e Ifthe device is configured to have an ACE interface, deassertion of ACINACTM to service an 
external snoop request on the AXI master snoop interface. 

e Ifthe device is configured to have a CHI interface: 


— Deassertion of SINACT to service an external snoop request. 
— Activation of TX or RX links. 
¢ If ACP is present, deassertion of AINACTS to service an ACP transaction on the slave interface. 


When the core exits from WFI low-power state STANDBYWFEFI for that core is deasserted. When the L2 
memory system logic exits from WFI low-power state, STANDBYWFIL2 is deasserted. 
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The following figure shows the L2 WFI timing for a 4-core configuration. 
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Figure 2-12 L2 Wait For Interrupt timing 


L2 hardware cache flush 


The processor provides an efficient way to fully clean and invalidate the L2 cache in preparation for 
powering it down without requiring the waking of a core to perform the clean and invalidate through 
software. 


Use of L2 hardware cache flush can only occur if specific requirements are met and the following 

sequence applied: 

1. Disable L2 prefetches by writing a one to bit [38] and zeros to bits [36:35] of the CPU Extended 
Control Register. 

2. Disable the load-store hardware prefetcher by writing a one to bit [56] of the CPU Auxiliary Control 
Register. 

3. Execute an ISB instruction to ensure the CPU Extended Control Register and CPU Auxiliary Control 
Register writes are complete. 

4. Execute a DSB instruction to ensure completion of any prior prefetch requests. 

All cores are in the WFI low-power state, so all the core STANDBYWFI outputs are asserted. 

6. When ACP is present and all outstanding ACP transactions are complete, the SoC asserts the 
AINACTS signal to idle the ACP. This is necessary to prevent ACP transactions from allocating new 
entries in the L2 cache while the hardware cache flush is occurring. When AINACTS has been 
asserted, the SoC must not assert ARVALIDS, AWVALIDS, or WVALIDS. 

7. The SoC can now assert the LAFLUSHREQ input. 

8. The L2 performs a series of internal clean and invalidate operations to each set and way of the L2 
cache. Any dirty cache lines are written back to the system using WriteBack or WriteNoSnoop 
operations. Clean cache lines can cause Evict or WriteEvict transactions if the L2 is configured. 

9. When the L2 completes the clean and invalidate sequence, it asserts the LAFLUSHDONE signal. 
The SoC can now deassert L2FLUSHREQ signal and then the L2 deasserts LAFLUSHDONE. 

10. When all outstanding snoop transactions are completed, the SoC can assert the ACINACTM signal 
in an ACE implementation or the SINACT signal in a CHI implementation. In response, the L2 
asserts the STANDBYWFIL2 signal. 


It is possible to terminate the L2 hardware cache flush by deasserting the LAFLUSHREQ signal before 
the LAFLUSHDONE signal is asserted. This causes the L2 to abort the hardware cache flush. This 
feature can be used when the SoC does not power down the core and must wake up the core quickly. 


nN 


The following figure shows the L2 hardware cache flush timing. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 2-45 
Non-Confidential 


2 Functional Description 
2.4 Power management 





CLK ! | 


m$ 
STANDBYWFI[N:0] / i 5 


AINACTS J 










































































L2FLUSHREQ 











45 L2 flush 











L2FLUSHDONE 








ACINACTM 





STANDBYWFIL2 





Figure 2-13 L2 hardware cache flush timing 


Related information 
4.3.67 CPU Extended Control Register, EL] on page 4-206. 


Processor dynamic retention 


When a core is in WFI low-power state or WFE low-power state, the clocks to the core are stopped. 
During these low-power states, the core might start the clocks for short periods of time to allow it to 
handle snoops or other short events but it remains in the low-power state. 


Whenever the clocks to a core are stopped, it is possible for an external power controller to place the core 
in a retention state to reduce leakage power consumption without state loss. 


Each core in the processor has a CPU Q-channel interface that allows an external power controller to 
place the core into a retention state. This interface consists of four pins: 


e CPUQACTIVE. 
* CPUQREQn. 
* CPUQACCEPTn. 
© CPUQDENY. 


The operational relationship of these signals are: 


e CPUQREQn can only go LOW, if CPUQACCEPTn is HIGH and CPUQDENY is LOW. 

« After CPUQREQn goes LOW, it must remain LOW until either CPUQACCEPTn goes LOW or 
CPUQDENY goes HIGH. 

e CPUQREQn can then go HIGH, and must remain HIGH until both CPUQACCEPTn is HIGH and 
CPUQDENY is LOW. 

e Each CPUQREQn request is followed by the assertion of either CPUQACCEPTn or CPUQDENY, 
but not both. CPUQACCEPTn cannot be asserted LOW at the same time as CPUQDENY is 
asserted HIGH. 


A typical sequence of the external power controller successfully placing the core in retention state is: 

1. The core executes a WFI instruction. The clocks in the core are stopped and STANDBYWFI is 
asserted. After the programmed number of Generic Timer CNTVALUEB ticks specified by 
CPUECTLR[2:0] field has elapsed, the CPUQACTIVE for that core is deasserted. This hints that 
retention is possible for that core. 

2. The external power controller asserts CPUQREQn to indicate that it wants to put that core into 
retention state. 

3. While the core is still in WFI low-power state and the clocks are stopped, the core accepts the 
retention request by asserting CPUQACCEPTn. 

4. While CPUQREQn and CPUQACCEPTn are both asserted, the core is in quiescent state and the 
external power controller can safely put the core into retention state. 
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5. During retention, if a snoop occurs to access the cache of the quiescent core, the CPUQACTIVE 

signal is asserted to request exit from retention. 

The external power controller brings the core out of retention and deasserts CPUQREQn. 

The core deasserts CPUQACCEPTn to complete the handshake. 

The clocks in the core are restarted temporarily to allow the snoop request to the core to proceed. 

After the snoop access is complete, the core deasserts CPUQACTIVE. 

0. CPUQREQn and CPUQACCEPTn are then asserted. The core has reentered quiescent state and the 
external power controller can put the core into retention state again. 

11. When the core is ready to exit WFI low-power state, CPUQACTIVE is asserted. 

12. CPUQREQn is then deasserted, the core exits WFI low-power state, and CPUQACCEPTn is 

deasserted. 


ae mae 


The following figure shows a typical sequence where the external power controller successfully places 
the core in retention state. 
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Figure 2-14 Successful retention timing 


The core enters WFI low-power state and deasserts CPUQACTIVE. The external power controller 
asserts CPUQREQn. If the core cannot safely enter quiescent state, it asserts CPUQDENY instead of 
CPUQACCEPTn. When this occurs, the external power controller cannot put that core into retention 
state. The external power controller must then deassert CPUQREQn, then the core deasserts 
CPUQDENY. 


The following figure shows a sequence where the external power controller attempts to put a core in 
retention state but the core denies the request. 
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Figure 2-15 Denied retention timing 











Guidelines on the use of core dynamic retention 


As cores generally only stay in WFE low-power state for a short period of time, ARM recommends that 
you only take a core into retention when it is in WFI low-power state. 


If the L1 data cache of a core that is in WFI low-power state contains data that is likely to be the target of 
frequent snoops from other cores, entering quiescent state and retention is likely to be inefficient. 
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When using the core retention feature, you must consider the following points: 

¢ During core reset, CPUQREQn must be deasserted HIGH while CPUQACCEPTn is asserted 
LOW. 

¢ The Processor dynamic retention control field in the CPU Extended Control Register, CPUECTLR, 
must be set to a nonzero value to enable this feature. If this field is @b@@@, all assertions of 
CPUQREQn LOW receive CPUQDENY responses. 

e Ifthe core dynamic retention feature is not used, CPUQREQn must be tied HIGH and the 
CPUECTLR retention control field set to disabled. 





Note 


If you use the core dynamic retention feature then the CPU Auxiliary Control Register, 
CPUACTLR[30:29] bits must be zero. 





Related information 
4.3.66 CPU Auxiliary Control Register, ELI on page 4-194. 
4.3.67 CPU Extended Control Register, EL] on page 4-206. 


L2 RAMs dynamic retention 


L2 RAM dynamic retention mode provides a way of saving power in an idle processor while allowing 
quick wake-up to service a snoop from ACE or CHI. The core supports dynamic retention of the L2 
Data, Dirty, Tag, Inclusion PLRU, and Snoop Tag RAMs. 


The processor has an L2 Q-channel interface that allows an external power controller to place the L2 
RAMs into a retention state. 


L2 RAM dynamic retention mode is entered and exited using the following sequence of events: 


1. All cores are in WFI or WFE low-power state and therefore, all the cores STANDBYWFI or 
STANDBYWFE outputs are asserted. 

2. When all pending L2 activity is complete, and the L2 remains idle for the programmed number of 
Generic Timer CNTVALUEB ticks, as specified by LZECTLR[2:0] field, the L2 deasserts 
L2QACTIVE. 

3. The external power controller asserts LAQREQn to indicate that it wants to put the L2 RAMs into 
retention state. 

4. If the L2 is still idle, it accepts the retention request by asserting LZAQACCEPTn. 

5. While LZ2QREQn and LZQACCEPTn are both asserted, the power controller can safely put the L2 
RAMs into retention state. 

6. Ifthe L2 detects that one or more cores have exited WFI low-power state, the ACP becomes active or 
a snoop request must be serviced, the L2 asserts LRQACTIVE to request exit from retention. 

7. The power controller brings the L2 RAMs out of retention and deasserts LZAQREQn. 

8. The L2 deasserts LAQACCEPTn to complete the handshake. 


The following figure shows the L2 dynamic retention timing. 
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Figure 2-16 L2 dynamic retention timing 


If the L2 exits idle in step 4 on page 2-48, it asserts LZAQDENY instead of LAQACCEPTn. In response, 
the power controller must deassert LZAQREQn, causing the L2 to deassert LIQDENY. 


The L2 dynamic retention control field in the L2 Extended Control Register, L2ZECTLR, must be set to a 
nonzero value to enable this feature. If this field is @b@@@, all assertions of LAQREQn LOW receive 
L2QDENY responses. 


If the L2 dynamic retention feature is not used, L2QREQn must be tied HIGH and the L2ECTLR 
retention control field set to disabled. 
Note 


If you use the L2 dynamic retention feature then the L2 Auxiliary Control Register, LZACTLR[28:27] 
bits must be zero. 





Related information 
4.3.59 L2 Extended Control Register, EL] on page 4-172. 
L2 Auxiliary Control Register, EL1. 


Advanced SIMD and FP clock gating 


The processor supports dynamic high-level clock gating of the Advanced SIMD and FP unit to reduce 
dynamic power dissipation. 


The clock to the Advanced SIMD and FP unit is enabled when an Advanced SIMD or FP instruction is 
detected in the pipeline, and is disabled otherwise. 


You can set bit[29] of the CPU Auxiliary Control Register, CPUACTLR_ELI, to 1 to disable dynamic 
clock gating of the Advanced SIMD or FP unit. 


Related information 
4.3.66 CPU Auxiliary Control Register, EL] on page 4-194. 
L2 control and tag banks clock gating 


The processor supports dynamic high-level clock gating of the shared L2 control logic and the two L2 
tag banks to reduce dynamic power dissipation. 


The L2 tag bank clocks are only enabled when a corresponding access to the L2 tag bank is detected in 
the pipeline. 


The L2 control logic is disabled after 256 consecutive idle cycles. It is then enabled when an L2 access is 
detected, with an additional 4-cycle penalty for the wake up before the access is serviced. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 2-49 
Non-Confidential 


2 Functional Description 
2.4 Power management 


You can set bit[28] of the L2 Auxiliary Control Register, LAACTLR_ELI, to 1 to disable dynamic clock 
gating of the L2 tag banks. 

You can set bit[27] of the L2 Auxiliary Control Register, LAACTLR_ELI, to 1 to disable dynamic clock 
gating of the L2 control logic. 


Related information 
L2 Auxiliary Control Register, EL1. 


Regional clock gating 


In addition to extensive local clock gating to register flops, you can configure the processor to include 
Regional Clock Gates (RCGs) that can perform additional clock gating of logic blocks such as the 
register banks to reduce dynamic power dissipation. 


You can set bit[63] of the CPUACTLR_ELI to 1 to disable regional clock gating for each processor. 
You can set bit[26] of the LZACTLR_ELI to 1 to disable regional clock gating in the L2, GIC, and 


Timer. 


Related information 
4.3.66 CPU Auxiliary Control Register, ELI on page 4-194. 
L2 Auxiliary Control Register, EL1. 
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2.4.2 


The processor supports the following power domains: 


Power domains 


Each core in the device. 

The L2 cache and Snoop Tag RAMs. 
A domain for: 

— The L2 control. 

— The GIC CPU interface. 

— The Generic Timer logic. 

The PCLKDBG domain for: 

— The Debug APB interface. 

— The CTI logic. 

— The CTM logic. 


Note 


2 Functional Description 
2.4 Power management 


The design does not support a separate power domain for the L1 cache and branch prediction RAMs 
within the core. It does not support L1 cache retention when the core is powered down. 

For L2 RAMs dynamic retention, the L2 Data, Dirty, Tag, Inclusion PLRU, and Snoop Tag RAMs are 
retained. For L2 cache Dormant mode, the L2 Data, Dirty, Tag, and Inclusion PLRU RAMs are 


retained. 





The following figure shows the supported power domains in the processor and the placeholders where 
you can insert clamps for a core. 
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Figure 2-17 Power domains 
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2.4.3 Power modes 


The power domains can be controlled independently to give different combinations of powered-up and 
powered-down domains. However, only some powered-up and powered-down domain combinations are 
valid and supported. 


The following table shows the valid powered-up and powered-down domain combinations for the 
different possible modes of operation. The table uses the following terms: 




















Off Block is powered down. 

WFx Block is in WFI or WFE low-power state. 

Ret Logic or RAM retention power only. 

On Block is powered up. 

Table 2-3 Valid power modes 
Mode Core‘ (CLK) Debug APB, CTI, and CTM L2 RAMs‘ (CLK) L2 control, GIC, 
(PCLKDBG) Timer (CLK) 

L2 control powerup and L2 RAMs On | WFx | Ret | Off! Off | On On On 
powerup 
L2 control powerup and L2 RAMs =WFXx | Ret | Off © Off | On Ret On 
retained 
L2 cache Dormant mode All Off Off | On On | Ret Off 
PCLKDBG powerup All Off On Off Off 
Processor shutdown All Off Off Off Off 





There are specific requirements that you must meet to power up and power down each power domain 
within the core. The supported powerup and powerdown sequences are: 

e Individual core powerdown on page 2-52. 

e Processor powerdown without system driven L2 flush on page 2-53. 

e Processor powerdown with system driven L2 flush on page 2-55. 

¢« Dormant mode on page 2-55. 

e Debug powerdown on page 2-57. 

¢ External debug over powerdown on page 2-57. 


Note 


¢ The powerup and powerdown sequences in the following sections are the only power sequences that 
ARM recommends. Any deviation from these sequences can lead to unpredictable results. 

e The powerup and powerdown sequences require that you isolate the powerup domain before power is 
removed from the powerdown domain. You must clamp the outputs of the powerdown domain to 
benign values to prevent data corruption or unpredictable behavior in the powerup domain. 








Individual core powerdown 


If an individual core is not required, you can reduce leakage power by turning off the power to the core. 
The core refers to all core logic, including Advanced SIMD and FP unit, LI RAMs, Debug, ETM, 
breakpoint and watchpoint logic. 





d Core, which includes the Advanced SIMD and FP, Debug, ETM, breakpoint and watchpoint (CLK) logic. 
e For L2 RAMs dynamic retention, the L2 Data, Dirty, Tag, Inclusion PLRU, and Snoop Tag RAMs are retained. 


For L2 cache Dormant mode, the L2 Data, Dirty, Tag, and Inclusion PLRU RAMs are retained. 
This power mode requires all the cores to be in one of On, WFI, WFE, Retention, or Off state. Each core can be in a different one of these states. 
8 This power mode requires all the cores to be in one of WFI, WFE, Retention, or Off state. Each core can be in a different one of these states. 
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To enable the core to be powered down, the implementation must place the core on a separately 
controlled power supply. In addition, you must clamp the outputs of the core to benign values while the 
core is powered down. 


To power down the core power domain, apply the following sequence: 


1. Clear the appropriate System Control Register C bit, data or unified cache enable, to prevent 
additional data cache allocation. 

2. Disable L2 prefetches by writing a one to bit [38] and zeros to bits [36:35] of the CPU Extended 
Control Register. 

3. Disable the Load-store hardware prefetcher by writing a one to bit [56] of the CPU Auxiliary Control 
Register. 

4. Execute an ISB instruction to ensure the CPU Extended Control Register and CPU Auxiliary Control 
Register writes are complete. 

5. Execute a DSB instruction to ensure completion of any prior prefetch requests. 

6. Clean and invalidate all data from the L1 data cache. The L2 duplicate Snoop Tag RAM for this core 
is now empty. This prevents any new data cache snoops or data cache maintenance operations from 
other processors in the processor being issued to this core. 

7. Clear the CPUECTLR.SMPEN bit. Clearing the SMPEN bit enables the core to be taken out of 
coherency by preventing the core from receiving instruction cache, TLB, or BTB maintenance 
operations broadcast by other processors in the multiprocessor. 

8. Ensure that the system does not send interrupts to the core that is being powered down. 

9. Set the DBGOSDLR.DLK, Double lock control bit, that forces the debug interfaces to be quiescent. 

10. Execute an ISB instruction to ensure that all of the System register changes from the previous steps 
have been committed. 

11. Execute a DSB instruction to ensure that all instruction cache, TLB, and branch predictor maintenance 
operations issued by any core in the processor before the SMPEN bit was cleared have completed. 

12. Execute a WFI instruction and wait until the STANDBYWFEFI output asserts to indicate that the core is 
idle and in the WFI low-power state. 

13. Activate the core output clamps. 

14. Remove power from the core power domain. 

To power up the core power domain, apply the following sequence: 

1. Assert nCPUPORESET. 

2. Apply power to the core power domain while keeping nCPUPORESET asserted. When power is 
restored, continue to hold nCPUPORESET for 16 CLK cycles to allow the reset to propagate. 

3. Release the core output clamps. 

4. Deassert nCPUPORESET. 


Processor powerdown without system driven L2 flush 


The Cortex-A72 processor supports processor powerdown where all the processor power domains are 
shut down and all state is lost. In this section, a lead core is defined as the last core to powerdown, or the 
first core to powerup. 


To power down the processor, apply the following sequence: 


1. Ensure all non-lead processors are in shutdown mode, see /ndividual core powerdown on page 2-52. 

2. For the lead processor, follow steps / on page 2-53 to 5 on page 2-53 in Individual core powerdown 
on page 2-52. 

3. When ACP is present and all outstanding ACP transactions are complete, the SoC can assert 
AINACTS to idle the ACP. When AINACTS has been asserted, the SoC must not assert 
ARVALIDS, AWVALIDS, or WVALIDS. 

4. Clean and invalidate all data from the L2 data cache. 

5. Ifthe core implements: 


An ACE interface 

When all outstanding snoop transactions are complete, the SoC can assert ACINACTM. 
A CHI interface 

When all outstanding snoop transactions are complete, the SoC can assert SINACT. 
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Ensure system interrupts to the processor are disabled. 

Follow steps 7 on page 2-53 to /4 on page 2-53 in Individual core powerdown on page 2-52. 
Wait until STANDBYWFIL2 asserts to indicate that the L2 memory system is idle. 

9. Activate the output clamps of the processor in the SoC. 

10. Remove power from the L2 control and L2 RAM power domains. 


aa 


To power up the Cortex-A72 processor, apply the following sequence: 

1. For each core in the MPCore device, assert nCPUPORESET LOW. 

2. For the lead core in the MPCore device, assert nPRESETDBG and nL2RESET LOW, and hold 
L2RSTDISABLE LOW. 

3. Apply power to the processor, L2 control, L2 RAM and debug power domains while keeping the 
signals described in steps / on page 2-53 and 2 on page 2-53 LOW. 

4. Release the output clamps of the processor in the SoC. 

5. Continue a normal powerup reset sequence. 
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Processor powerdown with system driven L2 flush 


The Cortex-A72 processor supports processor powerdown where all the processor power domains are 
shut down and all state is lost. In this section, a lead processor is defined as the last core to powerdown, 
or the first core to powerup. 


To power down the processor, apply the following sequence: 


1. Ensure all non-lead cores are in shutdown mode, see /ndividual core powerdown on page 2-52. 

2. For the lead core, follow steps / on page 2-53 to 5 on page 2-53 in Individual core powerdown 
on page 2-52. 

3. When ACP is present and all outstanding ACP transactions are complete, the SoC can assert 

AINACTS to idle the ACP. When AINACTS has been asserted, the SoC must not assert 

ARVALIDS, AWVALIDS, or WVALIDS. 

Ensure system interrupts to the processor are disabled. 

Follow steps 7 on page 2-53 to /4 on page 2-53 in Individual core powerdown on page 2-52. 

The SoC can now assert the LAFLUSHREQ input. 

The L2 performs a series of internal clean and invalidate operations to each set and way of the L2 

cache. 

8. When the L2 completes the clean and invalidate sequence, it asserts the LAFLUSHDONE signal. 
The SoC can now deassert L2FLUSHREQ signal and then the L2 deasserts LAFLUSHDONE. 

9. If the core implements: 


An ACE interface 
When all outstanding snoop transactions are complete, the SoC can assert ACINACTM to 
idle the AXI master interface. When ACINACTM has been asserted, the SoC must not assert 
ACVALIDM.. 
A CHI interface 
When all outstanding snoop transactions are complete, the SoC can assert SINACT. 
10. Wait until STANDBYWFIL2 asserts to indicate that the L2 memory system is idle. 
11. Activate the output clamps of the processor in the SoC. 
12. Remove power from the L2 control and L2 RAM power domains. 


TO oS 


To power up the Cortex-A72 processor, apply the following sequence: 

1. For each core in the MPCore device, assert nCPUPORESET LOW. 

2. For the lead core in the MPCore device, assert nPRESETDBG and nL2RESET LOW, and hold 
L2RSTDISABLE LOW. 

3. Apply power to the core, L2 control, L2 RAM and debug power domains while keeping the signals 
described in steps / on page 2-55 and 2 on page 2-55 LOW. 

4. Release the output clamps of the processor in the SoC. 

5. Continue a normal powerup reset sequence. 


Dormant mode 


The Cortex-A72 processor supports Dormant mode, where all the processors, debug PCLKDBG, and L2 
control logic are powered down while the L2 cache RAMs are powered up and retain state. 


This reduces the energy cost of writing dirty lines back to memory and improves response time on 
powerup. In Dormant mode, the L2 cache is not kept hardware coherent with other masters in the system. 


The RAM blocks that remain powered up and retained during Dormant mode are: 


e L2 Tag RAMs. 

e L2 Dirty RAMs. 

e L2 Data RAMs. 

e L2 Inclusion PLRU RAMs. 


To support Dormant mode, the L2 cache RAMs must be implemented in a separate power domain. In 
addition, you must clamp all inputs to the L2 cache RAMs to benign values, to avoid corrupting data 
when the processors and L2 control power domains enter and exit powerdown state. 
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Before entering Dormant mode, the architectural state of the processor, excluding the contents of the L2 
cache RAMs that remain powered up, must be saved to external memory. 


To exit from Dormant mode to Run mode, the SoC must perform a full powerup reset sequence. The SoC 
must assert the reset signals until power is restored. After power is restored, the processor exits the 
powerup reset sequence, and the architectural state must be restored. 


To enter Dormant mode, apply the following sequence: 


1. Clear the appropriate System Control Register C bit, data or unified cache enable, to prevent 
additional data cache allocation. 

2. Clean and invalidate all data from the L1 data cache. The L2 duplicate Snoop Tag RAM for this core 
is now empty. This prevents any new data cache snoops or data cache maintenance operations from 
other processors in the processor being issued to this core. 

3. Clear the CPUECTLR.SMPEN bit. Clearing the SMPEN bit enables the core to be taken out of 
coherency by preventing the core from receiving instruction cache, TLB, or BTB maintenance 
operations broadcast by other processors in the MPCore device. 

4. Ensure that the system does not send interrupts to the core that is being powered down. 

5. Save architectural state, if required. These state saving operations must ensure that the following 
occur: 

e All ARM registers, including the core state, are saved. 
e All System registers are saved. 
e All debug related state is saved. 

6. Set the DBGOSDLR.DLK, Double lock control bit, that forces the debug interfaces to be quiescent. 

7. Execute an ISB instruction to ensure that all of the System register changes from the previous steps 
have been committed. 

8. Execute a DSB instruction to ensure that all instruction cache, TLB, and branch predictor maintenance 
operations issued by any core in the processor before the SMPEN bit was cleared have completed. In 
addition, this ensures that all state saving has completed. 

9. Execute a WFI instruction and wait until the STANDBYWFI output is asserted, to indicate that the 
core is in idle and low-power state. 

10. Repeat the previous steps for all processors, and wait for all STANDBYWFI outputs to assert. 

11. If the processor implements: 


An ACE interface 
When all outstanding snoop transactions are complete, the SoC asserts ACINACTM. When 
ACINACTM has been asserted, the SoC must not assert ACVALIDM. 

A CHI interface 
When all outstanding snoop transactions are complete, the SoC asserts SINACT. 


When ACP is present and all outstanding ACP transactions are complete, the SoC asserts AINACTS. 
When AINACTS has been asserted, the SoC must not assert ARVALIDS, AWVALIDS, or 
WVALIDS. 


When the L2 completes the outstanding transactions for the AXI, or CHI, interface then 
STANDBYWFIL2 asserts to indicate that the L2 memory system is idle. 

12. When all of the core STANDBYWFI signals and the STANDBYWFIL2 are asserted, the processor 
is ready to enter Dormant mode. 

13. Activate the L2 cache RAM input clamps. 

14. Remove power from the cores, debug PCLKDBG, and L2 control power domains. 

To exit Dormant mode, apply the following sequence: 

1. Apply a normal powerup reset sequence. You must apply resets to the cores, debug PCLKDBG, and 
the L2 memory system logic until power is restored. During this reset sequence, LERSTDISABLE 
must be held HIGH to disable the L2 cache hardware reset mechanism. 

2. When power is restored, release the L2 cache RAM input clamps. 

3. Continue a normal powerup reset sequence with LARSTDISABLE held HIGH. The 
L2RSTDISABLE must be held HIGH for a minimum of 32 CLK cycles after the deasserting edge 
of nL2RESET. 

4. The architectural state must be restored, if required. 
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Debug powerdown 


If the Cortex-A72 processor runs in an environment where debug facilities are not required for any of its 
cores then you can reduce leakage power by turning off the power to the debug unit in the PCLKDBG 
domain. 


To enable the debug unit in the PCLKDBG domain to be powered down, the implementation must place 
the debug unit on a separately controlled power supply. In addition, you must clamp the outputs of the 
debug unit to benign values while the debug unit is powered down. 


To power down the debug PCLKDBG power domain, apply the following sequence: 


1. Activate the debug output clamps. 
2. Remove power from the debug PCLKDBG domain. 


Note 


If the debug output clamps are released without following the specified debug powerup sequence, the 
results are unpredictable. 








To power up the debug PCLKDBG power domain, apply the following sequence: 

1. Assert nPRESETDBG. 

2. Apply power to the debug PCLKDBG power domain while keeping nPRESETDBG asserted. 
3. Release the debug output clamps. 

4. If the SoC uses the debug hardware, deassert nPRESETDBG. 


External debug over powerdown 


The Cortex-A72 processor provides support for external debug over powerdown. If any or all of the 
cores are powered down, the SoC can still use the debug facilities if the debug PCLKDBG domain is 
powered up. 


To enable external debug over powerdown, the implementation must place the core and the debug 
PCLKDBG unit on separately controlled power supplies. If the core is powered down while the debug 
PCLKDBG unit is powered up, you must clamp all outputs from the core power domain to the debug 
power domain to benign values. 


To power down the core power domain for external debug over powerdown support, apply the following 
additional step to the core powerdown sequence, as described in Jndividual core powerdown 

on page 2-52, after STANDBYWEFTI is asserted in step 72 on page 2-53, and before core clamps are 
activated in step /3 on page 2-53: 


e Deassert DBGPWRDUP to indicate that the core debug resources are not available for APB 
accesses. 


When power is removed from the core power domain, keep the debug PCLKDBG unit powered up. 


To power up the core power domain after external debug over powerdown support is no longer required, 
apply the following additional step to the core powerup sequence, as described in /ndividual core 
powerdown on page 2-52, after nCPUPORESET is deasserted in step 5 on page 2-53. 

e Assert DBGPWRDUP to indicate that processor debug resources are available. 


Related information 
Dormant mode on page 2-55. 


2.4.4 Using SMPEN as a power mode indicator 


You can use the SMPEN output to differentiate between a retention and powerdown opportunity. 
However, this is not a requirement and this communication might occur because of other methods such 
as message passing between the core and external power controller. 


If SMPEN is HIGH, the core is still in coherency with the other cores in the processor and therefore only 
retention is appropriate. If SMPEN is LOW it indicates the core can be powered down. 
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2 Functional Description 
2.4 Power management 


If the SMPEN is sampled LOW when the CPU Q-Channel handshake has completed the transition to 
retention, the core can be returned to the active state using the Q-Channel, then if CPUQACTIVE is still 
LOW, the power controller can start a powerdown transition of the core. 
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Chapter 3 


Programmers Model 


This chapter describes the processor registers and provides information for programming the processor. 


It contains the following sections: 


e 3.1 About the programmers model on page 3-60. 
e 3.2 ARMVv8-A architecture concepts on page 3-61. 
¢ 3.3 ThumbEE instruction set on page 3-69. 

e 3.4 Jazelle implementation on page 3-70. 

e 3.5 Memory model on page 3-72. 
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3 Programmers Model 
3.1 About the programmers model 


3.1 About the programmers model 


The Cortex-A72 processor implements the ARMv8-A architecture. This includes: 


Support for all the Exception levels, EL3-ELO. 
Support for both Execution states, AArch64 and AArch32, at each Exception level. 
The following instruction sets: 


AArch64 Execution state 

The A64 instruction set. 
AArch32 Execution state 

The T32 and A32 instruction sets. 


The processor supports the following features: 


A32, T32, and A64 Advanced Single Instruction Multiple Data (SIMD) instructions. 
A32, T32, and A64 Floating-point instructions. 

A32, T32, and A64 optional Cryptography Extension instructions. 

Generic Timer. 


The processor does not support the T32EE (ThumbEE) instruction set. 





Note 


The optional Cryptography engine is not included in the base product of the processor. ARM requires 
licensees to have contractual rights to obtain the Cortex-A72 processor Cryptography engine. 








ARM 100095_0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 3-60 


Non-Confidential 


3 Programmers Model 
3.2 ARMv8-A architecture concepts 


3.2 ARMv8-A architecture concepts 
Introduces both the ARMv8-A architectural concepts and the associated terminology. 


The following sections describe the ARMv8-A architectural concepts. Each section introduces the 
corresponding terms that are used to describe the architecture. 
Note 


A thorough understanding of the terminology defined in this section is a prerequisite for reading the 
remainder of this manual. 








This section contains the following subsections: 

e 3.2.1 Execution state on page 3-61. 

e 3.2.2 Exception levels on page 3-62. 

e 3.2.3 Security state on page 3-63. 

e 3.2.4 Rules for changing Exception state on page 3-64. 
e 3.2.5 Stack Pointer selection on page 3-64. 

e 3.2.6 ARMV8 security model on page 3-65. 

e 3.2.7 Instruction set state on page 3-67. 

e 3.2.8 AArch32 execution modes on page 3-67. 


3.2.1 Execution state 


The Execution state defines the processor execution environment, including: 
e Supported register widths. 
e Supported instruction sets. 
e Significant aspects of: 
— The execution model. 
— The Virtual Memory System Architecture (VMSA). 
— The programmers model. 


The Execution states are: 


AArch64 

The 64-bit Execution state. This Execution state: 

e Features 31 64-bit general-purpose registers, with a 64-bit Program Counter (PC), Stack 
Pointer (SP), and Exception Link Registers (ELRs). 

e Provides a single instruction set, A64. 

e Defines the ARMv8 exception model, with four Exception levels, ELO-EL3, that provide an 
execution privilege hierarchy. 

e Features 48-bit Virtual Address (VA), held in 64-bit registers. The Cortex-A72 processor 
VMSA maps these to 44-bit Physical Address (PA) maps. 

¢ Defines a number of elements that hold the processor state (PSTATE). The A64 instruction 
set includes instructions that operate directly on various PSTATE elements. 

e Names each System register using a suffix that indicates the lowest Exception level that the 
register can be accessed. 
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3 Programmers Model 
3.2 ARMv8-A architecture concepts 


AArch32 

The 32-bit Execution state. This Execution state is backwards-compatible with implementations 

of the ARMv7-A architecture profile that include the Security Extensions and the Virtualization 

Extensions. This Execution state: 

e Features 13 32-bit general purpose registers, and a 32-bit PC, SP, and Link Register (LR). 
Some of these registers have multiple Banked instances for use in different processor modes. 

e Provides 32 64-bit registers for Advanced SIMD and Floating-point support. 

¢ Provides two instruction sets, A32 and T32. 

e Provides an exception model that maps the ARMv7 exception model onto the ARMv8 
exception model and Exception levels. For exceptions taken to an Exception level that is 
using AArch32, this supports the ARMv7 exception model use of processor modes. 

e Features 32-bit VAs. The VMSA maps these to 40-bit PAs. 

e Collects processor state into the Current Processor State Register (CPSR). 


The processor can move between Execution states only on a change of Exception level, and subject to 
the rules given in 3.2.4 Rules for changing Exception state on page 3-64. This means different software 
layers, such as an application, an operating system kernel, and a hypervisor, executing at different 
Exception levels, can execute in different Execution states. 


Related information 
3.2.7 Instruction set state on page 3-67. 


3.2.2 Exception levels 


The ARMVv8 exception model defines Exception levels ELO-EL3, where: 


° ELO has the lowest software execution privilege, and execution at ELO is called unprivileged 
execution. 

e Increased values of n, from 1 to 3, indicate increased software execution privilege. 

e EL2 provides support for processor virtualization. 

¢ EL3 provides support for two security states. 


The Cortex-A72 processor implements all the Exception levels, ELO-EL3, and supports both Execution 
states, AArch64 and AArch32, at each Exception level. 


Execution can move between Exception levels only on taking an exception, or on returning from an 
exception: 


e On taking an exception, the Exception level either increases or remains the same. The Exception level 
cannot decrease on taking an exception. 

e On returning from an exception, the Exception level either decreases or remains the same. The 
Exception level cannot increase on returning from an exception. 


The Exception level that execution changes to, or remains in, on taking an exception, is called the target 
Exception level of the exception and: 
¢ Every exception type has a target Exception level that is either: 
— Implicit in the nature of the exception. 
— Defined by configuration bits in the System registers. 
e An exception cannot target the ELO Exception level. 


Exception levels, and privilege levels, are defined within a particular Security state, and 3.2.6 ARMv8 
security model on page 3-65 describes the permitted combinations of Security state and Exception 
level. 


Exception terminology 


This section defines terms used to describe the navigation between Exception levels. 
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3 Programmers Model 
3.2 ARMv8-A architecture concepts 


Terminology for taking an exception 


An exception is generated when the processor first responds to an exceptional condition. The processor 
state at this time is the state the exception is taken from. The processor state immediately after taking the 
exception is the state the exception is taken to. 


Terminology for returning from an exception 


To return from an exception, the processor must execute an exception return instruction.The processor 
state when an exception return instruction is committed for execution is the state the exception returns 
from. The processor state immediately after the execution of that instruction is the state the exception 
returns to. 


Exception level terminology 


An Exception level, ELn, with a larger value of n than another Exception level, is described as being a 
higher Exception level than the other Exception level. For example, EL3 is a higher Exception level than 
ELI. 


An Exception level with a smaller value of n than another Exception level is described as being a lower 
Exception level than the other Exception level. For example, ELO is a lower Exception level than EL1. 


An Exception level is described as: 


Using AArch64 

When execution in that Exception level is in AArch64 Execution state. 
Using AArch32 

When execution in that Exception level is in AArch32 Execution state. 


Typical Exception level usage model 


The architecture does not specify how software can use the different Exception levels but the following 
is a common usage model for the Exception levels: 

ELO Applications. 

EL1 OS kernel and associated functions that are typically described as privileged. 

EL2 Hypervisor. 


EL3 Secure monitor. 


Related information 
3.2.3 Security state on page 3-63. 


3.2.3 Security state 


An ARMvV8 implementation that includes the EL3 Exception level provides the following Security states, 
each with an associated memory address space: 


Secure state 
In Secure state, the processor: 
e Can access both the Secure and the Non-secure memory address space. 
e When executing at EL3, can access all the system control resources. 
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3 Programmers Model 
3.2 ARMv8-A architecture concepts 


Non-secure state 
In Non-secure state, the processor: 
e Can access only the Non-secure memory address space. 
e Cannot access the Secure system control resources. 


The AArch32 Security state model is unchanged from the model for an ARMv7-A architecture profile 
implementation that includes the Security Extensions and the Virtualization Extensions. When the 
implementation uses the AArch32 state for all Exception levels, many System registers are Banked to 
provide Secure and Non-secure instances, and: 

e The Secure instance is accessible only at EL3. 

e The Non-secure instance is accessible at EL1 or higher. 

e The two instances of a Banked register have the same name. 


The 3.2.6 ARMv8 security model on page 3-65 describes how the Security state interacts with other 
aspects of the ARMV8 architectural state. 


3.2.4 Rules for changing Exception state 


This introduction to moving between Execution states does not consider exceptions caused by debug 
events. 


The Execution state, AArch64 or AArch32, can change only on a change of Exception level, meaning it 
can change only on either: 


¢ Taking an exception to a higher Exception level. 
e Returning from an exception to a lower Exception level. 
Note 


The Execution state cannot change if, on taking an exception or on returning from an exception, the 
Exception level remains the same. 








On taking an exception to a higher Exception level, the Execution state: 


e Can either: 
— Remain the same. 
— Change from AArch32 state to AArch64 state. 
e Cannot change from AArch64 state to AArch32 state. 


On returning from an exception to a lower Exception level, the Execution state: 


e Can either: 
— Remain the same. 
— Change from AArch64 state to AArch32 state. 
e Cannot change from AArch32 state to AArch64 state. 


On powerup and on reset, the processor enters EL3, the highest Exception level. The Execution state for 

this Exception level is controlled by the configuration input signal, AA64nAA32. For the other 

Exception levels the Execution state is determined as follows: 

e For an exception return to ELO, the ELO Execution state is specified as part of the exception return, 
subject to the rules given in this section. 

e Otherwise, the Execution state is determined by one or more System register configuration bits, that 
can be set only in a higher Exception level. 


3.2.5 Stack Pointer selection 
Stack Pointer behavior depends on the Execution state, as follows: 


AArch64 
In ELO, the Stack Pointer (SP) maps to the SP_ELO Stack Pointer register. 
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Taking an exception selects the default Stack Pointer for the target Exception level, meaning SP 
maps to the SP_ELx Stack Pointer register, where x is the Exception level. 


Software executing in the target Exception level can execute an MSR SPSel, #Imm1 instruction 
to select whether to use the default SP_ELx Stack Pointer or the SP_ELO Stack Pointer. 


The selected Stack Pointer can be indicated by a suffix to the Exception level: 


t Indicates use of the SPO Stack Pointer. 
h Indicates use of the SPx Stack Pointer. 





Note 


The t and h suffixes are based on the terminology of thread and handler, introduced in ARMv7- 
M. 





The following table shows the set of AArch64 Stack Pointer options. 


Table 3-1 AArch64 Stack Pointer options 





Exception level AArch64 Stack Pointer options 














ELO ELOt 

EL1 ELIt, EL1h 
EL2 EL2t, EL2h 
EL3 EL3t, EL3h 





AArch32 
In AArch32 state, each mode that can be the target of an exception has its own Banked copy of 
the Stack Pointer. For example, the Banked Stack Pointer for Hyp mode is called SP_hyp. 
Software executing in one of these modes uses the Banked Stack Pointer for that mode. 


The modes that have Banked copies of the Stack Pointer are FIQ mode, IRQ mode, Supervisor 
mode, Abort mode, Undefined mode, Hyp mode, and Monitor mode. Software executing in 
User mode or System mode uses the User mode Stack Pointer, SP_usr. 


Related information 
3.2.8 AArch32 execution modes on page 3-67. 


3.2.6 ARMvV8 security model 


The Cortex-A72 processor implements all of the Exception levels. This means: 


e EL3 exists only in Secure state and a change from Secure state to Non-secure state is made only by 
an exception return from EL3. 
e EL2 exists only in Non-secure state. 


To provide compatibility with ARMv7, the Exception levels available in Secure state are modified when 
EL3 is using AArch32. The following sections describe the security model: 

¢ Security model when EL3 is using AArch64 on page 3-66. 

e Security model when EL3 is using AArch32 on page 3-66. 
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EL1 


EL2 


EL3 


Security model when EL3 is using AArch64 


When EL3 is using AArch64, The following figure shows the security model, and the expected use of 
the different Exception levels. This figure shows how instances of ELO and EL] are present in both 


3 Programmers Model 
3.2 ARMv8-A architecture concepts 


Security states. The figure also shows the expected software usage of the Exception levels. 


Non-secure state 





Secure state 











AArch32 or AArch64+ 


Guest OS1 


AArch32 or AArch64* 


Guest OS2 














AArch32 or AArch64 


Secure OS 














t AArch64 permitted only if EL1 is using AArch64 
$ AArch64 permitted only if EL2 is using AArch64 


Figure 3-1 ARMvé8 security model when EL3 is using AArch64 


Security model when EL3 is using AArch32 


To provide software compatibility with VMSAv7 implementations that include the Security Extensions, 
in Secure AArch32 state, all modes other than User mode must have the same execution privilege. This 


means that, in an implementation where EL3 is using AArch32, the security model is as shown in 


following figure. This figure also shows the expected use of the different Exception levels and processor 


modes. 
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ELO 


EL1 


EL2 


EL3 


3.2.7 


3.2.8 


Non-secure state 











AArch32 
Guest OS1 


System, FIQ, IRQ, 
Supervisor, Abort, Undefined 








AArch32 
Guest OS2 


System, FIQ, IRQ, 
Supervisor, Abort, Undefined 
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Secure state 








Figure 3-2 ARMv8 security model when EL3 is using AArch32 


For more information about the AArch32 processor modes see 3.2.8 AArch32 execution modes 


on page 3-67. 


Instruction set state 


The processor instruction set state determines the instruction set that the processor executes. The possible 
instruction sets depend on the Execution state: 


AArch64 


AArch64 state supports only a single instruction set, called A64. This is a fixed-width 
instruction set that uses 32-bit instruction encoding. 


AArch32 


AArch32 state supports the following instruction sets: 


A32 


This is a fixed-length instruction set that uses 32-bit instruction encodings. It is 


compatible with the ARMv7 ARM instruction set. 


T32 


This is a variable-length instruction set that uses both 16-bit and 32-bit instruction 
encodings. It is compatible with the ARMv7 Thumb instruction set. 


AArch32 execution modes 


ARMv/7 and earlier versions of the ARM architecture, define a set of named processor modes, including 
modes that correspond to different exception types. For compatibility, AArch32 state retains these 


processor modes. 


The following table shows the AArch32 processor modes, and the Exception level of each mode. 
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3 Programmers Model 
3.2 ARMv8-A architecture concepts 


Table 3-2 AArch32 processor modes and associated Exception levels 





AArch32 processor mode EL3 using 


Security state Exception level 





User AArch32 or AArch64 


Non-secure or Secure ELO 





System, FIQ, IRQ, Supervisor, AArch64 


Non-secure or Secure ELI! 




















Abort, Undefined AArch32 Non-secure ELI 

Secure EL3 
Hyp AArch32 or AArch64 Non-secure only EL2 
Monitor AArch32 Secure only EL3 





When the EL3 using column of The following table shows: 


AArch64 The row refers to information shown in figure Figure 3-1 ARMv8 security model when EL3 


is using AArch64 on page 3-66. 


AArch32 The row refers to information shown in figure Figure 3-2 ARMv8 security model when EL3 


is using AArch32 on page 3-67. 


A processor mode name does not indicate the current Security state. To distinguish between a mode in 


Secure state and the equivalent mode in Non-secure state, the mode name is qualified as Secure or Non- 
secure. For example, a description of AArch32 operation in EL1 might relate to the Secure FIQ mode, or 


to the Non-secure FIQ mode. 
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3.3 ThumbEE instruction set 


3.3 ThumbEE instruction set 


The Thumb Execution Environment (ThumbEE) extension is a variant of the Thumb instruction set that is 
designed as a target for dynamically generated code. 


The processor does not implement the T32EE (ThumbEE) instruction set. 


In AArch32 state, access to the ThumbEE Configuration Register, TEECR, and ThumbEE Handler Base 
Register, TEEHBR, results in an Undefined Instruction trap. 


In AArch64 state, these registers are named TEECR32_EL1 and TEEHBR32_EL]I respectively, and 
access to these registers results in an Undefined Instruction trap. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 3-69 
Non-Confidential 


3 Programmers Model 
3.4 Jazelle implementation 


3.4 Jazelle implementation 
AArch32 state supports a trivial Jazelle implementation. 


This means: 


e Jazelle state is not supported. 
e The BX) instruction behaves as a BX instruction. 


See the ARM” Architecture Reference Manual ARMV8 for more information. 


3.4.1 Register summary 


The following table gives a summary of the processor Jazelle registers that are accessed through the 
CP14 coprocessor in the AArch32 state. These registers are not implemented in the AArch64 state. 


Table 3-3 Summary of Jazelle registers 





CRn op1 CRm op2 Name Reset Description 





c0 T c0 0 JIDR 0x00000008 Jazelle Identity Register 





cl T c0 0 JOSCR 0x000000090 Jazelle OS Control Register 





c2 7 c0 0 JMCR @0x000000090 Jazelle Main Configuration Register 





Related information 

Jazelle Identity Register on page 3-70. 

Jazelle OS Control Register on page 3-71. 

Jazelle Main Configuration Register on page 3-71. 


3.4.2 Register description 


This section describes the processor Jazelle Extension registers. The following table provides cross- 
references to individual registers. 


Jazelle Identity Register 


The JIDR characteristics are: 


Purpose 
Enables software to determine the implementation of the Jazelle Extension provided by the 
processor. 
Usage constraints 
The JIDR is: 
e A read-only register 
e Accessible from all Exception levels in AArch32. 


Configurations 
Available in all configurations. 
Attributes 
See the register summary in table Zable 3-3 Summary of Jazelle registers on page 3-70. 


The JIDR is a 32-bit register with all bits[31:0] as Reso. Writes are ignored, and all bits read as zero. 
To access the JIDR in the AArch32 state, read the register with: 


MRC p14, 7, <Rd>, c@, c@, @; Read Jazelle Identity Register 
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Jazelle OS Control Register 


The JOSCR characteristics are: 


Purpose 

Provides operating system control of the use of the Jazelle Extension. 
Usage constraints 

The JOSCR is: 

e A read/write register 

e Accessible only from EL1 or higher. 


Configurations 
Available in all configurations. 
Attributes 
See the register summary in table Zable 3-3 Summary of Jazelle registers on page 3-70. 


The JOSCR is a 32-bit register with all bits[31:0] as REso. Writes are ignored, and all bits read as zero. 
To access the JOSCR in the AArch32 state, read or write the register with: 


MRC p14, 7, <Rd>, c1, c@, @; Read Jazelle OS Control Register 
MCR p14, 7, <Rd>, c1, c@, ©; Write Jazelle OS Control Register 


Jazelle Main Configuration Register 
The JMCR characteristics are: 


Purpose 

Provides control of the Jazelle Extension features. 
Usage constraints 

The JMCR is: 

e A read/write register 

e Accessible only from EL1 or higher. 


Configurations 
Available in all configurations. 
Attributes 
See the register summary in table Zable 3-3 Summary of Jazelle registers on page 3-70. 


The JMCR is a 32-bit register with all bits[31:0] as Reso. Writes are ignored, and all bits read as zero. 
To access the JMCR in the AArch32 state, read or write the register with: 


MRC p14, 7, <Rd>, c2, c@, @; Read Jazelle Main Configuration Register 
MCR p14, 7, <Rd>, c2, c@, @; Write Jazelle Main Configuration Register 
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3.5 Memory model 


The Cortex-A72 processor views memory as a linear collection of bytes numbered in ascending order 
from zero. 


For example, bytes 0-3 hold the first stored word, and bytes 4-7 hold the second stored word. 
The processor can store words in memory as either: 


e Big-endian format. 
e Little-endian format. 


See the ARM® Architecture Reference Manual ARMV8 for more information about big-endian and little- 
endian memory systems. 
Note 


Instructions are always treated as little-endian. 
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Chapter 4 
System Control 


This chapter describes the System registers, their structure, operation, and how to use them. 


It contains the following sections: 

e 4.1 About system control on page 4-74. 

e 4.2 AArch64 register summary on page 4-75. 

e 4.3 AArch64 register descriptions on page 4-88. 
e 4.4 AArch32 register summary on page 4-214. 

e 4.5 AArch32 register descriptions on page 4-239. 
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4.1 About system control 


The System registers control and provide status information for the functions implemented in the 
processor. 


The main functions of the System registers are: 


e Overall system control and configuration. 

e Memory Management Unit (MMU) configuration and management. 
e Cache configuration and management. 

e System performance monitoring. 

e Generic Interrupt Controller (GIC) configuration and management. 


The System registers are accessible in AArch32 and AArch64 states. The Execution states are described 
in the 3.2 ARMvS8-A architecture concepts on page 3-61. The System register access in AArch64 state is 
characterized by three possible scenarios. These scenarios are: 


¢ The AArch64 register is unique and described for the AArch64 state in 4.3 AArch64 register 
descriptions on page 4-88. 

e The AArch64 register is architecturally mapped to an AArch32 register but has different bit or bit 
field assignments. There a separate descriptions for each Execution state in 4.3 AArch64 register 
descriptions on page 4-88 and 4.5 AArch32 register descriptions on page 4-239. 

e The AArch64 register is architecturally mapped to an AArch32 register with the same bit and bit field 
assignments. There is one description for both Execution states in the 4.3 AArch64 register 
descriptions on page 4-88 and cross-referenced from the 4.4 AArch32 register summary 
on page 4-214. 


The System registers accessed in AArch32 state are described in the 4.5 AArch32 register descriptions 
on page 4-239, 

Some of the System registers can be accessed through the memory-mapped or external debug interfaces. 
Bits in the System registers that are described in the ARMv7 architecture are redefined in the ARMv8-A 
architecture: 


e UNK/SBZP, RAZ/SBZP, and RAZ/WI are redefined as RESO. 
e UNK/SBOP and RAO/SBOP are redefined as REs1. 


RESO and RES! are described in the ARM® Architecture Reference Manual ARMV8, for ARMv8-A 
architecture profile. 


This section contains the following subsections: 
e 4.1.1 Registers affected by CPI5SSDISABLE on page 4-74. 


4.1.1 Registers affected by CP15SDISABLE 


The CP1I5SDISABLE signal disables write access to certain secure copies of System registers when EL3 
is using AArch32. For a list of registers affected by CPISSDISABLE, see the ARM® Architecture 
Reference Manual ARMVv8. 


The Cortex-A72 processor does not have any IMPLEMENTATION DEFINED registers that are affected by 
CP15SDISABLE. 
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4.2 AArch64 register summary 


This section gives a summary of the System registers in AArch64 state. 


For more information about using the System registers, see the ARM” Architecture Reference Manual 
ARMVv8. 


This section contains the following subsections: 

e 4.2.1 AArch64 identification registers on page 4-75. 

e 4.2.2 AArch64 exception handling registers on page 4-77. 

e 4.2.3 AArch64 virtual memory control registers on page 4-78. 
e 4.2.4 AArch64 other System registers on page 4-79. 

e 4.2.5 AArch64 cache maintenance operations on page 4-79. 

¢ 4.2.6 AArch64 TLB maintenance operations on page 4-80. 

e 4.2.7 AArch64 address translation operations on page 4-80. 

e 4.2.8 AArch64 miscellaneous operations on page 4-81. 

e 4.2.9 AArch64 Performance Monitors registers on page 4-82. 
e 4.2.10 AArch64 reset registers on page 4-82. 

e 4.2.11 Security registers on page 4-82. 

e 4.2.12 AArch64 virtualization registers on page 4-83. 

e 4.2.13 AArch64 EL2 TLB maintenance operations on page 4-85. 
¢ 4.2.14 Generic Timer registers on page 4-85. 

e 4.2.15 AArch64 IMPLEMENTATION DEFINED registers on page 4-86. 


4.2.1 AArch64 identification registers 


The following table shows the identification registers in AArch64 state. Bits[63:32] are reset to 
0x00000000 for all 64-bit registers in the table. 


Table 4-1 AArch64 identification registers 





Name 


Type Reset Width Description 





MIDR _ EL1 


RO @x410FD083 32 4.3.1 Main ID Register, 
ELI on page 4-89 





MPIDR_ EL1 


RO 0x80000003” 64 4.3.2 Multiprocessor 
Affinity Register, EL1 
on page 4-90 





REVIDR_ EL1 


RO 0x00000000 32 4.3.3 Revision ID 
Register, EL] 
on page 4-92 





ID_PFRO EL1 


RO 0x00000131 32 4.3.4 AArch32 Processor 
Feature Register 0, EL] 
on page 4-93 





ID PFRI ELI 


RO 0x00011011' 32 4.3.5 AArch32 Processor 
Feature Register 1, EL1 
on page 4-94 





ID_DFRO ELI 


RO 0x03010066 32 4.3.6 AArch32 Debug 
Feature Register 0, ELI 
on page 4-95 








h The reset value depends on the primary inputs, CLUSTERIDAFF1 and CLUSTERIDAFF2, and the number of cores that the processor implements. The value 
. shown is for a four-core implementation, with CLUSTERIDAFF1 and CLUSTERIDAFF?2 set to zero. 
1 The reset value depends on the primary input GICCDISABLE. The value shown assumes the GICCDISABLE signal is tied HIGH. 
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Table 4-1 AArch64 identification registers (continued) 





Name 


ID_AFRO ELI 


Type 
RO 


Reset 


0x00000000 


Width 
32 


Description 


4.3.7 AArch32 Auxiliary 
Feature Register 0, EL1 
on page 4-96 





ID_MMEFRO_EL1 


RO 


Qx10201105 


32 


4.3.8 AArch32 Memory 
Model Feature Register 
0, ELI on page 4-96 





ID_MMER1 ELI 


RO 


0x40000000 


32 


4.3.9 AArch32 Memory 
Model Feature Register 
1, ELI on page 4-98 





ID_ MMFR2 EL! 


RO 


0x01260000 


32 


4.3.10 AArch32 Memory 
Model Feature Register 
2, EL1 on page 4-99 





ID MMFR3 ELI 


RO 


0x02102211 


32 


4.3.11 AArch32 Memory 
Model Feature Register 
3, ELI on page 4-101 





ID_ISARO_EL1 


RO 


Qx02101110 


32 


4.3.12 AArch32 
Instruction Set Attribute 
Register 0, ELI 

on page 4-103 





ID_ISARI_EL1 


RO 


@x13112111 


32 


4.3.13 AArch32 
Instruction Set Attribute 
Register 1, ELI 

on page 4-104 





ID_ISAR2 ELI 


RO 


@x21232042 


32 


4.3.14 AArch32 
Instruction Set Attribute 
Register 2, ELI 

on page 4-106 





ID_ISAR3 ELI 


RO 


0x01112131 


32 


4.3.15 AArch32 
Instruction Set Attribute 
Register 3, EL] 

on page 4-107 





ID_ISAR4 ELI 


RO 


0x00011142 


32 


4.3.16 AArch32 
Instruction Set Attribute 
Register 4, ELI 

on page 4-108 





ID_ISAR5 ELI 


RO 


0x00010001İ 


32 


4.3.17 AArch32 
Instruction Set Attribute 
Register 5, ELI 

on page 4-110 





ID_AA64PFR0_EL1 


RO 


0x00002222 


64 


4.3.18 AArch64 
Processor Feature 
Register 0, ELI 
on page 4-111 








j The reset value is 0x00011121 if the Cryptography engine is implemented. 
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Table 4-1 AArch64 identification registers (continued) 





Name 


Type Reset Width Description 





ID_AA64DFRO EL1 


RO 0x10305106 64 4.3.19 AArch64 Debug 
Feature Register 0, ELI 
on page 4-113 





ID_AA64ISARO EL1 


RO exeee1e000 64 4.3.20 AArch64 
Instruction Set Attribute 
Register 0, ELI 
on page 4-114 





ID_AA64MMFRO EL1 


RO 0x00001124 64 4.3.21 AArch64 Memory 
Model Feature Register 
0, ELI on page 4-115 





CCSIDR_EL1 


RO UNK 32 4.3.22 Cache Size ID 
Register, ELI 
on page 4-117 





CLIDR_EL1 


RO 0x0A200023 32 4.3.23 Cache Level ID 
Register, ELI 
on page 4-118 





AIDR_EL1 


- 0x00000000 32 4.3.24 Auxiliary ID 
Register, ELI 
on page 4-120 





CSSELR_ELI1 


RW UNK 32 4.3.25 Cache Size 
Selection Register, ELI 
on page 4-120 





CTR_ELO 


RO 0x8444C004 32 4.3.26 Cache Type 
Register, ELO 
on page 4-121 





DCZID_ELO 


RO 0x00000004 32 4.3.27 Data Cache Zero 
ID, ELO on page 4-122 





VPIDR_EL2 


RW -l 32 4.3.28 Virtualization 
Processor ID Register, 
EL2 on page 4-123 





VMPIDR_EL2 


RO = 64 4.3.2 Multiprocessor 
Affinity Register, EL1 
on page 4-90 





4.2.2 AArch64 exception handling registers 


The following table shows the fault handling registers in AArch64 state. Bits[63:32] are reset to 
0x00000000 for all 64-bit registers in the following table. 





k 
I 


The reset value is 0x@0011120 if the Cryptography engine is implemented. 
The reset value is the value of the Main ID Register. 


M The reset value is the value of the Multiprocessor Affinity Register. 
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Table 4-2 AArch64 exception handling registers 








































































































Name Type Reset Width Description 
AFSRO_EL1 RW RESO 32 4.3.48 Auxiliary Fault Status Register 0, EL1 and EL3 on page 4-156 
AFSR1_EL1 RW RESO 32 4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 on page 4-157 
ESR_EL1 RW UNK 32 4.3.50 Exception Syndrome Register, EL] and EL3 on page 4-157 
IFSR32_EL2 RW UNK 32 4.3.51 Instruction Fault Status Register, EL2 on page 4-159 
AFSRO_EL2 RW RESO 32 4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp Auxiliary Data Fault Status 
Register on page 4-163 
AFSR1_EL2 RW ~ REso 32 4.3.53 Auxiliary Fault Status Register 1, EL2 and Hyp Auxiliary Instruction Fault Status 
Register on page 4-163 
ESR_EL2 RW UNK 32 4.3.54 Exception Syndrome Register, EL2 on page 4-163 
AFSRO_EL3 RW RES0 32 4.3.55 Physical Address Register, EL1 on page 4-165 
AFSR1_EL3 RW RESO 32 4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 on page 4-157 
ESR_EL3 RW UNK 32 4.3.50 Exception Syndrome Register, ELI and EL3 on page 4-157 
FAR EL1 RW UNK 64 Fault Address Register, EL1 
FAR _EL2 RW UNK 64 Fault Address Register, EL2 ” 
HPFAR_EL2 RW 0x@0@08000 64 Hyp IPA Fault Address Register, EL2 " 
FAR_EL3 RW UNK 64 Fault Address Register, EL3 ” 
VBAR ELI RW UNK 64 Vector Base Address Register, EL1 ” 
ISR_EL1 RO UNK 32 Interrupt Status Register ” 
VBAR EL2 RW UNK 64 Vector Base Address Register, EL2 ” 
4.2.3 AArch64 virtual memory control registers 
The following table shows the virtual memory control registers in AArch64 state. Bits[63:32] are reset to 
0x00000000 for all 64-bit registers in the following table. 
Table 4-3 AArch64 virtual memory control registers 
Name Type Reset Width Description 
SCTLR_EL1 RW = 0x@0C50838 32 4.3.30 System Control Register, EL1 on page 4-125 
SCTLR_EL2 RW = 0x30C50838 32 System Control Register, EL2 
SCTLR_EL3 RW = 0x@0C50838° 32 4.3.38 System Control Register, EL3 on page 4-141 
TTBRO_EL1 RW UNK 64 Translation Table Base Address Register 0, EL1 P 
TTBR1_EL1 RW UNK 64 Translation Table Base Address Register 1, EL1 P 
TCR_EL1 RW UNK 64 4.3.41 Translation Control Register, ELI on page 4-146 
TTBRO_EL2 RW UNK 64 Translation Table Base Address Register 0, EL2 P 
TCR_EL2 RW UNK 32 4.3.42 Translation Control Register, EL2 on page 4-149 








n See the ARM” Architecture Reference Manual ARMVé8 for more information. 
The reset value depends on primary input CFGTE. Table 4-3 AArch64 virtual memory control registers on page 4-78 assumes this signal is LOW. 
P See the ARM” Architecture Reference Manual ARMVé8 for more information. 
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Table 4-3 AArch64 virtual memory control registers (continued) 















































Name Type Reset Width Description 

VTTBR_EL2 RW UNK 64 Virtualization Translation Table Base Address Register, EL2 P 

VTCR_EL2 RW UNK 32 4.3.43 Virtualization Translation Control Register, EL2 on page 4-151 

TTBRO_EL3 RW UNK 64 Translation Table Base Address Register 0, EL3 P 

TCR_EL3 RW UNK 32 4.3.47 Translation Control Register, EL3 on page 4-155 

MAIR EL1 RW UNK 64 Memory Attribute Indirection Register, EL1 P 

AMAIR_EL1 RW RESO 64 4.3.56 Auxiliary Memory Attribute Indirection Register, EL1 and EL3 
on page 4-168 

MAIR EL2 RW UNK 64 Memory Attribute Indirection Register, EL2 P 

AMAIR EL2 RW RESO 64 4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 on page 4-168 

MAIR _EL3 RW UNK 64 Memory Attribute Indirection Register, EL3 P 

AMAIR EL3 RW RESO 64 4.3.56 Auxiliary Memory Attribute Indirection Register, EL] and EL3 
on page 4-168 

CONTEXTIDR EL! RW UNK 32 Context ID Register, EL1 P 





4.2.4 


4.2.5 


AArch64 other System registers 


The following table shows the other System registers in AArch64 state. 


Table 4-4 AArch64 other System registers 





Name 


Type Reset 


Width Description 





ACTLR_ ELI RW 


0x00000000 32 


4.3.31 Auxiliary Control Register, EL] on page 4-129 





CPACR_ ELI RW 


0x00000000 32 


4.3.32 Architectural Feature Access Control Register, ELI on page 4-129 





ACTLR_ EL2 RW 


0x00000000 32 


4.3.33 Auxiliary Control Register, EL2 on page 4-130 





AArch64 cache maintenance operations 


The following table shows the System instructions for cache and maintenance operations in AArch64 
state. See the ARM” Architecture Reference Manual ARMV8 for more information about these operations. 





Table 4-5 AArch64 cache maintenance operations 





Name Description 





IC IALLUIS Instruction cache invalidate all to PoU4 Inner Shareable 














Ic IALLU Instruction cache invalidate all to PoU 

IC IVAU Instruction cache invalidate by virtual address (VA) to POU 
DC IVAC Data cache invalidate by VA to PoC" 

DC ISW Data cache invalidate by set/way 





q PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 data cache or outside of the processor, in which case PoU is 


dependent on the external memory system. 
PoC = Point of Coherence. The PoC is always outside of the processor and is dependent on the external memory system. 


g 





ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 


4-79 
Non-Confidential 


4 System Control 
4.2 AArch64 register summary 


Table 4-5 AArch64 cache maintenance operations (continued) 





Name Description 





DC CSW Data cache clean by set/way 





DC CISW Data cache clean and invalidate by set/way 





DC ZVA Data cache zero by VA 





DC CVAC Data cache clean by VA to PoC 





DC CVAU Data cache clean by VA to PoU 





DC CIVAC Data cache clean and invalidate by VA to PoC 








4.2.6 AArch64 TLB maintenance operations 
The following table shows the System instructions for TLB maintenance operations in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information about these operations. 
Table 4-6 AArch64 TLB maintenance operations 
Name Description 





TLBI VMALLE1IS Invalidate all stage 1 translations used at EL1 with the current virtual machine identifier (VMID) in the Inner 









































Shareable 
TLBI VAE1IS Invalidate translation used at EL1 for the specified VA and Address Space Identifier (ASID) and the current 
VMID, Inner Shareable 
TLBI ASIDE11IS  Invalidate all translations used at EL1 with the current VMID and the supplied ASID, Inner Shareable 
TLBI VAAE1IS Invalidate all translations used at EL1 for the specified address and current VMID and for all ASID values, Inner 
Shareable 
TLBI VALE1IS Invalidate all entries from the last level of stage 1 translation table walk used at EL1 with the supplied ASID and 
current VMID, Inner Shareable 
TLBI VAALE1IS  Invalidate all entries from the last level of stage 1 translation table walk used at EL1 for the specified address and 
current VMID and for all ASID values, Inner Shareable 
TLBI VMALLE1 Invalidate all stage 1 translations used at EL1 with the current VMID 
TLBI VAE1 Invalidate translation used at EL1 for the specified VA and ASID and the current VMID 
TLBI ASIDE1 Invalidate all translations used at EL1 with the current VMID and the supplied ASID 
TLBI VAAE1 Invalidate all translations used at EL1 for the specified address and current VMID and for all ASID values 
TLBI VALE1 Invalidate all entries from the last level of stage 1 translation table walk used at EL1 with the supplied ASID and 
current VMID 
TLBI VAALE1 Invalidate all entries from the last level of stage 1 translation table walk used at EL1 for the specified address and 
current VMID and for all ASID values 
The Virtualization registers include additional TLB operations for use in Hyp mode. For more 
information, see 4.2.13 AArch64 EL2 TLB maintenance operations on page 4-85. 
4.2.7 AArché64 address translation operations 
The following table shows the address translation register in AArch64 state. 
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Table 4-7 AArch64 address translation register 





















































Name Type Reset Width Description 
PAR _ELI RW UNK ° 64 4.3.55 Physical Address 
Register, ELI 
on page 4-165 
The following table shows the System instructions for address translation operations in AArch64 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information. 
Table 4-8 AArch64 address translation operations 

Name Description 

AT S1E1R Stage | current state EL1 read 

AT S1E1W Stage 1 current state EL1 write 

AT S1E@R Stage 1 current state unprivileged read 

AT S1E@W Stage 1 current state unprivileged write 

AT S1E2R Stage 1 Hyp mode read 

AT S1E2W Stage 1 Hyp mode write 

AT S12E1R Stages 1 and 2 Non-secure EL1 read 

AT S12E1W Stages 1 and 2 Non-secure EL1 write 

AT S12E@R Stages 1 and 2 Non-secure unprivileged read 

AT S12E@W Stages 1 and 2 Non-secure unprivileged write 

AT S1E3R Stage | current state EL3 read 

AT S1E3W Stage 1 current state EL3 write 

4.2.8 AArch64 miscellaneous operations 


The following table shows the miscellaneous operations in AArch64 state. See the ARM® Architecture 
Reference Manual ARMV8 for more information about these operations. 


Table 4-9 AArch64 miscellaneous System operations 


























Name Type Reset Width Description 

TPIDR_ELO RW UNK 64 Thread Pointer / ID Register, ELO 
TPIDR_EL1 RW UNK 64 Thread Pointer / ID Register, EL1 
TPIDRRO_ELO RW! UNK 64 Thread Pointer / ID Register, Read-Only, ELO 
TPIDR_EL2 RW UNK 64 Thread Pointer / ID Register, EL2 
TPIDR_EL3 RW UNK 64 Thread Pointer / ID Register, EL3 











S  Bits[63:32] are reset to 0xX00000OOA. 
t RO at ELO. 
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4.2.9 AArch64 Performance Monitors registers 
The following table shows the Performance Monitors registers in AArch64 state. Bits[63:32] are reset to 
0x000000090 for all 64-bit registers in the following table. 
Table 4-10 AArch64 Performance Monitors registers 
Name Type Reset Width Description 
PMCR_ELO RW" @x41023000 32 11.4.1 Performance Monitors Control Register, ELO on page 11-401 
PMCNTENSET ELO RW UNK 32 Performance Monitors Count Enable Set Register 
PMCNTENCLR ELO RW UNK 32 Performance Monitors Enable Count Clear Register Y 
PMOVSCLR_ELO RW UNK 32 Performance Monitors Overflow Flag Status Register Y 
PMSWINC ELO WO - 32 Performance Monitors Software Increment Register Y 
PMSELR_ELO RW UNK 32 Performance Monitors Event Counter Selection Register Y 
PMCEIDO_ELO RO @Xx7FFF@F3F 32 11.4.2 Performance Monitors Common Event Identification Register 0, ELO 
on page 11-403 
PMCEID1_ ELO RO 0x@G0000028 32 Performance Monitors Common Event Identification Register 1 Y 
PMCCNTR_ELO RW UNK 64 Performance Monitors Cycle Count Register Y 
PMXEVTYPER ELO RW UNK 32 Performance Monitors Selected Event Type Register Y 
PMCCFILTR_ELO RW 0x00000000 32 Performance Monitors Cycle Count Filter Register “ 
PMXEVCNTR ELO RW UNK 32 Performance Monitors Selected Event Count Register Y 
PMUSERENR ELO RW _ 0x@0000008 32 Performance Monitors User Enable Register Y 
PMINTENSET ELI RW UNK 32 Performance Monitors Interrupt Enable Set Register Y 
PMINTENCLR ELI RW UNK 32 Performance Monitors Interrupt Enable Clear Register Y 
PMOVSSET_ELO RW UNK 32 Performance Monitors Overflow Flag Status Set Register Y 
4.2.10 AArché64 reset registers 
The following table shows the reset registers in AArch64 state. 
Table 4-11 AArch64 reset registers 
Name Type Reset Width Description 
RVBAR EL3 RO -V 64 4.3.60 Reset Vector Base Address, EL3 on page 4-174 
RMR_EL3 RW 0x00000000* 32 4.3.61 Reset Management Register, EL3 on page 4-175 
4.2.11 Security registers 
The following table shows the Security registers in AArch64 state. 
u Access permissions also depend on the access condition. See //.2.5 External register access permissions on page 11-398. 
Vv See the ARM” Architecture Reference Manual ARMVé8 for more information. 
W The reset value depends on the RVBARADDR signal. Bits[63:32] are reset to @2x00000000. 
X For a Cold reset, the AA64nAA32 signal sets the value of bit[0]. The following table assumes this signal is LOW. 
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Table 4-12 AArch64 security registers 





Name Type Reset Width Description 





SCR_EL3 RW @0x00000000 32 Secure Configuration Register, EL3 





SDER32_EL3 RW @0x00000000 32 Secure Debug Register, EL3 Y 





CPTR_EL3 RW 0x00000400 32 4.3.40 Architectural Feature Trap Register, EL3 on page 4-145 





MDCR_EL3 RW 0x00000000 32 Monitor Debug Configuration Register, EL3 Y 











AFSRO_EL3 RW RESO 32 4.3.48 Auxiliary Fault Status Register 0, ELI and EL3 on page 4-156 
AFSR1_EL3 RW RESO 32 4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 on page 4-157 
VBAR EL3 RW UNK? 64 Vector Base Address Register, EL3 Y 





4.2.12 AArché64 virtualization registers 


The following table shows the virtualization registers in AArch64 state. Bits[63:32] are reset to 
0x00000000 for all 64-bit registers in the following table. 


Table 4-13 AArch64 virtualization registers 



































Name Type Reset Width Description 
VPIDR_EL2 RW ad 32 4.3.28 Virtualization 
Processor ID Register, EL2 
on page 4-123 
VMPIDR_EL2 RW -ab 64 4.3.29 Virtualization 
Multiprocessor ID 
Register, EL2 
on page 4-124 
SCTLR_EL2 RW 0x30C50838 32 Secure Control Register, 
EL3 
ACTLR_EL2 RW 0x00000000 32 4.3.33 Auxiliary Control 
Register, EL2 
on page 4-130 
HCR EL2 RW 0x00000000 64 4.3.34 Hypervisor 
Configuration Register, 
EL2 on page 4-131 
MDCR_EL2 RW exeegeeee6®! 32 Monitor Debug 
Configuration Register, 
EL2 *° 
CPTR_EL2 RW 0x000033FF 32 4.3.35 Architectural 
Feature Trap Register, EL2 
on page 4-137 
Y See the ARM” Architecture Reference Manual ARMv8 for more information. 
Z The reset value of bits[63:32] is @x80000000. 
aa The reset value is the value of the Main ID Register. 
ab The reset value is the value of the Multiprocessor Affinity Register. 
ac See the ARM” Architecture Reference Manual ARMVv8 for more information. 
ad The reset value for bit[7] is UNK. 
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Table 4-13 AArch64 virtualization registers (continued) 





Name 


Type 


Reset 


Width 


Description 





HSTR_EL2 


RW 


0x00000000 


32 


4.3.36 Hypervisor System 
Trap Register 
on page 4-139 





HACR_EL2 


RW 


0x00000000 


32 


4.3.37 Hyp Auxiliary 
Configuration Register 
on page 4-141 





TTBRO_EL2 


RW 


UNK 


64 


Translation Table Base 
Address Register 0, EL3 *° 





TCR_EL2 


RW 


UNK 


32 


4.3.42 Translation Control 
Register, EL2 
on page 4-149 





VTTBR_EL2 


RW 


UNK 


64 


Virtualization Translation 
Table Base Address 
Register, EL2 °° 





VTCR_EL2 


RW 


UNK 


32 


4.3.43 Virtualization 
Translation Control 
Register, EL2 
on page 4-151 





DACR32_EL2 


RW 


0x00000000 


32 


Domain Access Control 
Register, EL2 °° 





AFSRO_EL2 


RW 


RESO 


32 


4.3.52 Auxiliary Fault 
Status Register 0, EL2 and 
Hyp Auxiliary Data Fault 
Status Register 

on page 4-163 





AFSR1_EL2 


RW 


RESO 


32 


4.3.53 Auxiliary Fault 
Status Register 1, EL2 and 
Hyp Auxiliary Instruction 
Fault Status Register 

on page 4-163 





ESR_EL2 


RW 


0x00000000 


32 


Exception Syndrome 
Register, EL2 ° 





FAR EL2 


RW 


UNK 


64 


Fault Address Register, 
EL2 a% 





HPFAR_EL2 


RW 


0x00000000 


64 


Hyp IPA Fault Address 
Register, EL2 ®° 





MAIR _EL2 


RW 


UNK 


64 


Memory Attribute 
Indirection Register, EL2 ®° 





AMAIR EL2 


RW 


RESO 


64 


4.3.57 Auxiliary Memory 
Attribute Indirection 
Register, EL2 

on page 4-168 





VBAR_EL2 


RW 


UNK 


64 


Vector Base Address 
Register, EL2 °° 








ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 


Non-Confidential 


4-84 


4 System Control 
4.2 AArch64 register summary 




































































4.2.13 AArch64 EL2 TLB maintenance operations 
The following table shows the System instructions for TLB maintenance operations added in AArch64 
state. See the ARM” Architecture Reference Manual ARMv8 for more information about these operations. 
Table 4-14 AArch64 TLB maintenance operations 

Name Description 

TLBI IPAS2E1IS Invalidate stage 2 only translations used at EL1 for the specified IPA for the current VMID, Inner Shareable 

TLBI IPAS2LE1IS Invalidate entries from the last level of stage 2 only translation used at EL1 for the specified IPA for the 
current VMID, Inner Shareable 

TLBI ALLE2IS Invalidate all stage 1 translations used at EL2, Inner Shareable 

TLBI VAE2IS Invalidate translation used at EL2 for the specified VA and ASID and the current VMID, Inner Shareable 

TLBI ALLE1IS Invalidate all stage 1 translations used at EL1, Inner Shareable 

TLBI VALE2IS Invalidate all entries from the last level of stage 1 translation table walk used at EL2 with the supplied ASID 
and current VMID, Inner Shareable 

TLBI VMALLS12E1IS Invalidate all stage 1 and 2 translations used at EL1 with the current VMID, Inner Shareable 

TLBI IPAS2E1 Invalidate stage 2 only translations used at EL1 for the specified IPA for the current VMID 

TLBI IPAS2LE1 Invalidate entries from the last level of stage 2 only translation used at EL1 for the specified IPA for the 
current VMID 

TLBI ALLE2 Invalidate all stage 1 translations used at EL2 

TLBI VAE2 Invalidate translation used at EL2 for the specified VA and ASID and the current VMID 

TLBI ALLE1 Invalidate all stage 1 translations used at EL1 

TLBI VALE2 Invalidate all entries from the last level of stage 1 translation table walk used at EL2 with the supplied ASID 
and current VMID 

TLBI VMALLS12E1 Invalidate all stage 1 and 2 translations used at EL1 with the current VMID 

TLBI ALLE3IS Invalidate all stage 1 translations used at EL3, Inner Shareable 

TLBI VAE3IS Invalidate translation used at EL3 for the specified VA and ASID and the current VMID, Inner Shareable 

TLBI VALE3IS Invalidate all entries from the last level of stage 1 translation table walk used at EL3 with the supplied ASID 
and current VMID, Inner Shareable 

TLBI ALLE3 Invalidate all stage 1 translations used at EL3 

TLBI VAE3 Invalidate translation used at EL3 for the specified VA and ASID and the current VMID 

TLBI VALE3 Invalidate all entries from the last level of stage 1 translation table walk used at EL3 with the supplied ASID 
and current VMID 

4.2.14 Generic Timer registers 


See Chapter 9 Generic Timer on page 9-338 for information on the Generic Timer registers. 
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4.2.15 AArch64 IMPLEMENTATION DEFINED registers 
The following table shows the IMPLEMENTATION DEFINED registers in AArch64 state. These registers provide 
test features and any required configuration options specific to the Cortex-A72 processor. If a register is 
not indicated as mapped to an AArch32 64-bit register, bits[63:32] are 0xe9ee00e8. 
Table 4-15 AArch64 IMPLEMENTATION DEFINED registers 
Name Type Reset Width Description 
ACTLR_EL1 RW _ RESO 32 4.3.31 Auxiliary Control Register, EL] on page 4-129 
ACTLR_EL2 RW 0x00000000 32 4.3.33 Auxiliary Control Register, EL2 on page 4-130 
ACTLR_EL3 RW @0x00000000 32 4.3.39 Auxiliary Control Register, EL3 on page 4-143 
AFSRO_EL1 RW _ RESO 32 4.3.48 Auxiliary Fault Status Register 0, ELI and EL3 
on page 4-156 
AFSR1_EL1 RW RESO 32 4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 
on page 4-157 
AFSRO_EL2 RW RESO 32 4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp Auxiliary 
Data Fault Status Register on page 4-163 
AFSR1_EL2 RW _ RESO 32 4.3.53 Auxiliary Fault Status Register 1, EL2 and Hyp Auxiliary 
Instruction Fault Status Register on page 4-163 
AFSRO_EL3 RW _ RESO 32 4.3.48 Auxiliary Fault Status Register 0, ELI and EL3 
on page 4-156 
AFSR1_EL3 RW RESO 32 4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 
on page 4-157 
AMAIR EL1 RW _ RESO 64 4.3.56 Auxiliary Memory Attribute Indirection Register, EL1 and 
EL3 on page 4-168 
AMAIR EL2 RW _ RESO 64 4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 
on page 4-168 
AMAIR EL3 RW RESO 64 4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 
on page 4-168 
L2CTLR_EL1 RW 0x00000000°° 32 4.3.58 L2 Control Register, EL1 on page 4-168 
L2ECTLR_EL1 RW 0x00000000 32 4.3.59 L2 Extended Control Register, ELI on page 4-172 
ILIDATAO EL1 RW UNK 32 4.3.62 Instruction LI Data n Register, ELI on page 4-176 
ILIDATA1 ELI UNK 
ILIDATA2 ELI UNK 
ILIDATA3_EL1 UNK 
DLIDATAO_EL1 RW UNK 32 4.3.63 Data L1 Data n Register, ELI on page 4-177 
DLIDATAI ELI UNK 
DLIDATA2_EL1 UNK 
DLIDATA3 ELI UNK 
DLIDATA4 ELI UNK 

















ac The reset value depends on the processor implementation and the state of the LARSTDISABLE signal. 
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Table 4-15 AArch64 IMPLEMENTATION DEFINED registers (continued) 











Name Type Reset Width Description 
RAMINDEX WO - 32 4.3.64 RAM Index operation on page 4-178 
L2ACTLR_ELI RW exeeeeaeeeeeegeele” 32 L2 Auxiliary Control Register, ELI 





CPUACTLR_EL1 RW 0x00 0000 0000 8000 64 4.3.66 CPU Auxiliary Control Register, EL1 on page 4-194 





CPUECTLR_EL1*® RW 0x00 001B 0000 0000 64 4.3.67 CPU Extended Control Register, ELI on page 4-206 











CPUMERRSR EL1*® RW UNK 64 4.3.68 CPU Memory Error Syndrome Register, ELI on page 4-209 
L2MERRSR_EL1*8 RW UNK?! 64 4.3.69 L2 Memory Error Syndrome Register, EL] on page 4-210 
CBAR _EL1 RO UNK* 64 4.3.70 Configuration Base Address Register, ELI on page 4-212 








af This is the reset value for an ACE interface. For a CHI interface the reset value is @x@0@0000000004018. 
a8 Mapped to a 64-bit AArch32 register. 

ah Bits[47:40, 39:32, 31] are reset to zero. 

al The reset value depends on the primary input, PERIPHBASE[43:18]. 
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4.3 AArch64 register descriptions 
This section describes all the System registers when the processor is in AArch64 state. 


Table 4-1 AArch64 identification registers on page 4-75 through Table 4-15 AArch64 implementation 
defined registers on page 4-86 provide cross-references to individual registers. 


This section contains the following subsections: 

e 4.3.1 Main ID Register, EL1 on page 4-89. 

¢ 4.3.2 Multiprocessor Affinity Register, EL] on page 4-90. 

e 4.3.3 Revision ID Register, ELI on page 4-92. 

e 4.3.4 AArch32 Processor Feature Register 0, ELI on page 4-93. 

e 4.3.5 AArch32 Processor Feature Register 1, EL] on page 4-94. 

e 4.3.6 AArch32 Debug Feature Register 0, EL] on page 4-95. 

e 4.3.7 AArch32 Auxiliary Feature Register 0, EL] on page 4-96. 

e 4.3.8 AArch32 Memory Model Feature Register 0, ELI on page 4-96. 

e 4.3.9 AArch32 Memory Model Feature Register 1, ELI on page 4-98. 

e 4.3.10 AArch32 Memory Model Feature Register 2, EL1 on page 4-99. 

© 4.3.11 AArch32 Memory Model Feature Register 3, ELI on page 4-101. 
e 4.3.12 AArch32 Instruction Set Attribute Register 0, ELI on page 4-103. 
e 4.3.13 AArch32 Instruction Set Attribute Register 1, EL] on page 4-104. 
e 4.3.14 AArch32 Instruction Set Attribute Register 2, ELI on page 4-106. 
e 4.3.15 AArch32 Instruction Set Attribute Register 3, ELI on page 4-107. 
e 4.3.16 AArch32 Instruction Set Attribute Register 4, ELI on page 4-108. 
e 4.3.17 AArch32 Instruction Set Attribute Register 5, EL] on page 4-110. 
e 4.3.18 AArch64 Processor Feature Register 0, ELI on page 4-111. 

e 4.3.19 AArch64 Debug Feature Register 0, EL] on page 4-113. 

e 4.3.20 AArch64 Instruction Set Attribute Register 0, EL] on page 4-114. 
¢ 4.3.21 AArch64 Memory Model Feature Register 0, EL] on page 4-115. 
e 4.3.22 Cache Size ID Register, EL1 on page 4-117. 

e 4.3.23 Cache Level ID Register, EL] on page 4-118. 

e 4.3.24 Auxiliary ID Register, EL1 on page 4-120. 

e 4.3.25 Cache Size Selection Register, EL] on page 4-120. 

e 4.3.26 Cache Type Register, ELO on page 4-121. 

¢ 4.3.27 Data Cache Zero ID, ELO on page 4-122. 

¢ 4.3.28 Virtualization Processor ID Register, EL2 on page 4-123. 

e 4.3.29 Virtualization Multiprocessor ID Register, EL2 on page 4-124. 

e 4.3.30 System Control Register, EL] on page 4-125. 

e 4.3.31 Auxiliary Control Register, ELI on page 4-129. 

e 4.3.32 Architectural Feature Access Control Register, ELI on page 4-129. 
e 4.3.33 Auxiliary Control Register, EL2 on page 4-130. 

e 4.3.34 Hypervisor Configuration Register, EL2 on page 4-131. 

e 4.3.35 Architectural Feature Trap Register, EL2 on page 4-137. 

e 4.3.36 Hypervisor System Trap Register on page 4-139. 

e 4.3.37 Hyp Auxiliary Configuration Register on page 4-141. 

e 4.3.38 System Control Register, EL3 on page 4-141. 

e 4.3.39 Auxiliary Control Register, EL3 on page 4-143. 

¢ 4.3.40 Architectural Feature Trap Register, EL3 on page 4-145. 

¢ 4.3.41 Translation Control Register, EL] on page 4-146. 

e 4.3.42 Translation Control Register, EL2 on page 4-149. 

¢ 4.3.43 Virtualization Translation Control Register, EL2 on page 4-151. 

¢ 4.3.44 Translation Table Base Register 0, ELI on page 4-152. 

¢ 4.3.45 Translation Table Base Register 0, EL3 on page 4-153. 

e 4.3.46 Translation Table Base Register 1, EL] on page 4-154. 

¢ 4.3.47 Translation Control Register, EL3 on page 4-155. 

¢ 4.3.48 Auxiliary Fault Status Register 0, EL] and EL3 on page 4-156. 
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e 4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 on page 4-157. 

e 4.3.50 Exception Syndrome Register, ELI and EL3 on page 4-157. 

¢ 4.3.51 Instruction Fault Status Register, EL2 on page 4-159. 

e 4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp Auxiliary Data Fault Status Register 
on page 4-163. 

e 4.3.53 Auxiliary Fault Status Register 1, EL2 and Hyp Auxiliary Instruction Fault Status Register 
on page 4-163. 

e 4.3.54 Exception Syndrome Register, EL2 on page 4-163. 

e 4.3.55 Physical Address Register, ELI on page 4-165. 

e 4.3.56 Auxiliary Memory Attribute Indirection Register, ELI and EL3 on page 4-168. 

e 4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 on page 4-168. 

e 4.3.58 L2 Control Register, EL] on page 4-168. 

e 4.3.59 L2 Extended Control Register, EL] on page 4-172. 

¢ 4.3.60 Reset Vector Base Address, EL3 on page 4-174. 

¢ 4.3.61 Reset Management Register, EL3 on page 4-175. 

¢ 4.3.62 Instruction LI Data n Register, ELI on page 4-176. 

e 4.3.63 Data LI Data n Register, EL] on page 4-177. 

¢ 4.3.64 RAM Index operation on page 4-178. 

e 4.3.65 L2 Auxiliary Control Register, EL] on page 4-188. 

e 4.3.66 CPU Auxiliary Control Register, ELI on page 4-194. 

e 4.3.67 CPU Extended Control Register, ELI on page 4-206. 

e 4.3.68 CPU Memory Error Syndrome Register, ELI on page 4-209. 

e 4.3.69 L2 Memory Error Syndrome Register, ELI on page 4-210. 

e 4.3.70 Configuration Base Address Register, ELI on page 4-212. 


4.3.1 Main ID Register, EL1 


The MIDR_ ELI characteristics are: 


Purpose 
Provides identification information for the processor, including an implementer code for the 
device and a device ID number. 

Usage constraints 
The accessibility to the MIDR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The external debug accessibility to the MIDR by condition code is: 





Off DLK OSLK EDAD SLK Default 





RO RO RO RO RO RO 





Table 10-1 External register access conditions on page 10-347 describes the condition codes. 
Configurations 

The MIDR_EL1 is: 

e Common to Secure and Non-secure states. 


e Architecturally mapped to the AArch32 MIDR register. 
e Architecturally mapped to external MIDR register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the MIDR_ELI bit assignments. 
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31 24 23 20:19 16.15 4 3 0 


Implementer | Varant, facia Primary part number 


Figure 4-1 MIDR_EL1 bit assignments 
The following table shows the MIDR_EL1 bit assignments. 


Table 4-16 MIDR_EL1 bit assignments 








Bits Name Function 
[31:24] Implementer Indicates the implementer code. This value is: 
0x41 ARM Limited. 
[23:20] Variant Indicates the variant number of the processor. This is the major revision number n in the rn part of the 


rnpn description of the product revision status. This value is: 





(2) Major revision number. 
[19:16] Architecture Indicates the architecture code. This value is: 
OxF Defined by CPUID scheme. 





[15:4] Primary part number Indicates the primary part number. This value is: 


@xDe8 Cortex-A72 processor. 





[3:0] Revision Indicates the minor revision number of the processor. This is the minor revision number n in the pn 
part of the rnpn description of the product revision status. This value is: 


3 Minor revision number. 





To access the MIDR_EL1 in AArch64 state, read the register with: 


MRS <Xt>, MIDR_EL1; Read Main ID Register 


To access the MIDR in AArch32 state, read the CP15 register with: 
MRC p15, ©, <Rt>, c@, c@, @; Read Main ID Register 


The MIDR can be accessed through the memory-mapped interface and the external debug interface, 
offset @xDee. 


4.3.2 Multiprocessor Affinity Register, EL1 
The MPIDR_ELI characteristics are: 


Purpose 
Provides an additional core identification mechanism for scheduling purposes in a cluster 
system. EDDEVAFFO is a read-only copy of MPIDR_EL1[31:0] accessible from the external 
debug interface. 
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Usage constraints 
The accessibility to the MPIDR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The external debug accessibility to the EDDEVAFFO0 by condition code is: 





Off DLK OSLK EDAD SLK Default 





s = e = = Re 





Table 10-1 External register access conditions on page 10-347 describes the condition codes. 
Configurations 

The MPIDR_EL1[31:0] is: 

e Architecturally mapped to the AArch32 MPIDR register. See 4.5.3 Multiprocessor Affinity 


Register on page 4-240 for more information. 
e Architecturally mapped to external EDDEVAFFO register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the MPIDR_EL1 bit assignments. 


63 32 31 30 29 25 24 23 16 15 210 





RES1— MT- CPU ID- 


Figure 4-2 MPIDR_EL1 bit assignments 
The following table shows the MPIDR_ELI bit assignments. 


Table 4-17 MPIDR_EL1 bit assignments 




















Bits Name Function 

[63:32] - Reserved, RESO. 

[31] - RES1. 

[30] U Indicates a single core system, as distinct from processor 0 in a cluster. This 
value is: 
0 Core is part of a cluster. 

[29:25] - Reserved, RES0. 

[24] MT Indicates whether the lowest level of affinity consists of logical cores that are 


implemented using a multi-threading type approach. This value is: 


0 Performance of cores at the lowest affinity level is largely independent. 





[23:16] Cluster ID Aff2 Affinity level 2. Second highest level affinity field. 


Indicates the value read in at reset, from the CLUSTERIDAFF2 
configuration signal. 





[15:8] Cluster ID Aff1 Affinity level 1. Third highest level affinity field. 


Indicates the value read in at reset, from the CLUSTERIDAFF1 
configuration signal. 
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Table 4-17 MPIDR_EL1 bit assignments (continued) 


























Bits Name Function 
[7:2] - Reserved, RESO. 
[1:0] CPU ID Indicates the core number in the Cortex-A72 processor. The possible values 
are: 
0x0 A cluster with one processor only. 
0x0, 0x1 A cluster with two processors. 
0x0, 0x1, 0x2 A cluster with three processors. 
0x0, 0x1, 0x2, 0x3 A cluster with four processors. 
To access the MPIDR_EL1 in AArch64 state, read the register with: 
MRS <Xt>, MPIDR_EL1; Read Multiprocessor Affinity Register 
The EDDEVAFFO can be accessed through the memory-mapped interface and the external debug 
interface, offset @xFA8. 
4.3.3 Revision ID Register, EL1 
The REVIDR_ ELI characteristics are: 
Purpose 
Provides implementation-specific minor revision information that can only be interpreted in 
conjunction with the MIDR_EL1. 
Usage constraints 
The accessibility to the REVIDR_EL1 by Exception level is: 
ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 
- RO RO RO RO RO 
Configurations 
The REVIDR_ELI is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 REVIDR register. 
The REVIDR ELI! is a 32-bit register. 
Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 
The following figure shows the REVIDR_EL1 bit assignments. 
31 0 
Figure 4-3 REVIDR_EL1 bit assignments 
The following table shows the REVIDR_EL1 bit assignments. 
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Table 4-18 REVIDR_EL1 bit assignments 





Bits Name Function 





[31:0] ID number Implementation-specific revision information. The reset value is determined by the specific Cortex-A72 processor 
implementation. 





To access the REVIDR_EL1 in AArch64 state, read the register with: 
MRS <Xt>, REVIDR_EL1; Read Revision ID Register 
To access the REVIDR in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c@, 6; Read Revision ID Register 


4.3.4 AArch32 Processor Feature Register 0, EL1 
The ID_PFRO ELI characteristics are: 


Purpose 

Provides information about the instruction sets supported by the processor in AArch32 state. 
Usage constraints 

The ID_PFRO EL1 must be interpreted with the ID_PFR1_ ELI. 


The accessibility to the ID_PFRO ELI by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID_PFRO ELI is: 


* Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_PFRO register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_PFRO_EL1 bit assignments. 


31 16 15 12 11 8 


7 4 3 0 


Figure 4-4 ID_PFRO_EL1 bit assignments 
The following table shows the ID_PFRO_ EL! bit assignments. 


Table 4-19 ID_PFRO_EL1 bit assignments 





Bits Name Function 





[31:16] - Reserved, RESO. 





[15:12] State3 Indicates support for Thumb Execution Environment (ThumbEE) instruction set. This value is: 


0x0 Processor does not implement the ThumbFE instruction set. 





[11:8] State2 Indicates support for Jazelle extension. This value is: 


0x1 Processor supports trivial implementation of Jazelle. 
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Table 4-19 ID_PFRO_EL1 bit assignments (continued) 





Bits Name Function 





[7:4]  Statel Indicates support for T32 instruction set. This value is: 


@x3 Processor supports T32 encoding after the introduction of Thumb-2 technology, and for all 16-bit and 32-bit 
T32 basic instructions. 





[3:0] | StateO Indicates support for A32 instruction set. This value is: 


@x1 Processor implements the A32 instruction set. 





To access the ID_PFRO_EL1 in AArch64 state, read the register with: 
MRS <Xt>, ID_PFR@_EL1; Read AArch32 Processor Feature Register 0 
To access the ID_PFRO in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c1, @; Read AArch32 Processor Feature Register @ 


4.3.5 AArch32 Processor Feature Register 1, EL1 


The ID_PFRI1_ ELI characteristics are: 


Purpose 

Provides information about the programmers model and extensions support in AArch32. 
Usage constraints 

The ID_PFR1 EL1 must be interpreted with the ID_PFRO ELI. 


The accessibility to the ID_PFR1_ ELI by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID_PFRI ELI is: 


¢ Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_PFR1 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_PFR1_EL1 bit assignments. 


31 28 27 20 19 16 15 12 11 8 


7 4 3 0 


Virtualization — 


Figure 4-5 ID_PFR1_EL1 bit assignments 
The following table shows the ID_PFR1_ EL! bit assignments. 
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Table 4-20 ID_PFR1_EL1 bit assignments 





Bits Name Function 





[31:28] GIC CP15 Indicates support for the GIC CP15 interface. The possible values are: 








0x0 No GIC CP15 registers are supported. This is the reset value when GICCDISABLE is tied 
HIGH. 
0x1 GICv3 CP15 registers are supported. This is the reset value when GICCDISABLE is tied 
LOW. 
[27:20] - Reserved, RESO. 
[19:16] GenTimer Indicates support for Generic Timer Extension. This value is: 
0x1 Processor supports Generic Timer Extension. 





[15:12] Virtualization Indicates support for Virtualization Extensions. This value is: 


0x1 Processor supports Virtualization Extensions. 





[11:8] MProgMod Indicates support for M-profile programmers model. This value is: 





0x0 Processor does not support M-profile programmers model. 
[7:4] Security Indicates support for Security Extensions. This value is: 
@x1 Processor supports Security Extensions. This includes support for Monitor mode and the 


SMC instruction. 





[3:0] ProgrMod Indicates support for the standard programmers model for ARMv4 and later. This value is: 


@x1 Processor supports the standard programmers model for ARMV4 and later. The model 
supports User, FIQ, IRQ, Supervisor, Abort, Undefined, and System modes. 





To access the ID_PFR1_EL1 in AArch64 state, read the register with: 
MRS <Xt>, ID_PFR1_EL1; Read AArch32 Processor Feature Register 1 
To access the ID_PFR1 in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c1, 1; Read AArch32 Processor Feature Register 1 


4.3.6 AArch32 Debug Feature Register 0, EL1 


The ID_DFRO ELI characteristics are: 


Purpose 

Provides top-level information about the debug system in AArch32 state. 
Usage constraints 

The ID_DFRO_EL1 must be interpreted with the MIDR_EL1. 


The accessibility to the ID _DFRO_EL1 by Exception level is: 


ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID_DFRO_ ELI is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_DFR0O register. 
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Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_DFRO EL1I bit assignments. 


28 27 24 23 20 19 16 15 12 11 


4 System Control 
4.3 AArch64 register descriptions 


MProfDbg | MMapTrc MMapDbg | CopSDbg | CopDbg 


Figure 4-6 ID_DFRO_EL1 bit assignments 


The following table shows the ID_DFRO_ELI bit assignments. 


Table 4-21 ID_DFRO_EL1 bit assignments 
































Bits Name Function 
[31:28] - Reserved, RESO. 
[27:24] PerfMon Indicates support for coprocessor-based ARM Performance Monitors Extension. This value is: 
@x3 Processor supports Performance Monitors Extension, PMUv3 System registers. 
[23:20] MProfDbg Indicates support for memory-mapped debug model for M-profile processors. This value is: 
@x@ Processor does not support M-profile Debug architecture, with memory-mapped access. 
[19:16] MMapTre Indicates support for memory-mapped trace model. This value is: 
@x1 Processor supports ARM trace architecture, with memory-mapped access. 
[15:12] CopTre Indicates support for coprocessor-based trace model. This value is: 
Qx® Processor does not support ARM trace architecture, with CP14 access. 
[11:8] _ MMapDbg Indicates support for memory-mapped debug model. This value is: 
@x® Processor does not support the memory-mapped debug model. 
[7:4] | CopSDbg Indicates support for coprocessor-based Secure debug model. This value is: 
0x6 Processor supports v8-A Debug architecture, with CP14 access. 
[3:0]  CopDbg Indicates support for coprocessor-based debug model. This value is: 
0x6 Processor supports v8-A Debug architecture, with CP14 access. 
To access the ID DFRO_EL1 in AArch64 state, read the register with: 
MRS <Xt>, ID_DFR@_EL1; Read AArch32 Debug Feature Register @ 
To access the ID_DFRO in AArch32 state, read the CP15 register with: 
MRC p15, ©, <Rt>, c@, c1, 2; Read AArch32 Debug Feature Register @ 
4.3.7 AArch32 Auxiliary Feature Register 0, EL1 
The processor does not implement ID_AFRO ELI. This register is always RESO. 
4.3.8 AArch32 Memory Model Feature Register 0, EL1 
The ID MMFRO _ ELI characteristics are: 
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Purpose 
Provides information about the implemented memory model and memory management support 
in AArch32. 
Usage constraints 
The ID MMFRO_ EL1 must be interpreted with: 
e ID MMFRI ELI. 
e ID _MMFR2 ELI. 
e ID MMFR3 ELI. 


The accessibility to the ID MMFRO_ ELI by Exception level is: 


ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID MMFRO ELI is: 


* Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_MMFRO register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID MMFRO_ ELI bit assignments. 


28 27 24 23 20 19 16 15 12 11 


FOSE jason | Tem ShareLvi | Outershr | Pusa | VMSA 


Figure 4-7 ID_MMFRO0_EL1 bit assignments 
The following table shows the ID_MMFRO_EL!1 bit assignments. 


Table 4-22 ID_MMFRO_EL1 bit assignments 





Bits Name 


Function 





[31:28] InnerShr 


Indicates the innermost shareability domain implemented. This value is: 


@x1 Processor implements hardware coherency support. 





[27:24] FCSE 


Indicates support for Fast Context Switch Extension (FCSE). This value is: 


Ox Processor does not support FCSE. 








[23:20] AuxReg 


Indicates support for Auxiliary registers. This value is: 


0x2 Processor supports the ACTLR, AIFSR and ADFSR. See 4.3.39 Auxiliary Control Register, 
EL3 on page 4-143,4.3.48 Auxiliary Fault Status Register 0, ELI and EL3 on page 4-156, and 
4.3.49 Auxiliary Fault Status Register 1, ELI and EL3 on page 4-157. 





[19:16] TCM 


Indicates support for TCMs and associated DMAs. This value is: 


0x® Processor does not support TCM. 





[15:12] ShareLvl 


Indicates the number of shareability levels implemented. This value is: 


@x1 Processor implements two levels of shareability. 





[11:8] OuterShr 


Indicates the outermost shareability domain implemented. This value is: 


@x1 Processor supports hardware coherency. 
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Table 4-22 ID_MMFRO_EL1 bit assignments (continued) 





Bits Name Function 





[7:4] PMSA Indicates support for a Protected Memory System Architecture (PMSA). This value is: 


0x0 Processor does not support PMSA. 





[3:0] VMSA Indicates support for a Virtual Memory System Architecture (VMSA). This value is: 


0x5 Processor supports: 
e VMSAv7, with support for remapping and the Access flag 
¢ Privileged Execute Never (PXN) bit in the Short-descriptor translation table format 
¢ The Long-descriptor translation table format. 





To access the ID MMFRO_EL1 in AArch64 state, read the register with: 
MRS <Xt>, ID_MMFR@_EL1; Read AArch32 Memory Model Feature Register @ 
To access the ID_ MMFRO in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c1, 4; Read AArch32 Memory Model Feature Register @ 


4.3.9 AArch32 Memory Model Feature Register 1, EL1 


The ID MMFRI ELI characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
in AArch32. 
Usage constraints 
The ID MMFRI1 ELI must be interpreted with: 
e ID MMFRO ELI. 
e ID MMFR2 ELI. 
e ID MMFR3 ELI. 


The accessibility to the ID_MMFR1_EL1 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID MMFRI ELI is: 


¢ Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID MMEFRI register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID MMFR1_ ELI bit assignments. 


28 27 24 23 20 19 16 15 12 11 


L1TstCln L1Hvd L1UniSW | L1HvdSW | L1UniVA | L1HvdVA 


Figure 4-8 ID_MMFR1_EL1 bit assignments 
The following table shows the ID MMFR1 bit assignments. 
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Table 4-23 ID_MMFR1_EL1 bit assignments 








Bits Name Function 
[31:28] BPred Indicates branch predictor management requirements. This value is: 
0x4 Branch predictor does not require flushing at any time. 





[27:24] L1TstCln Indicates the supported L1 data cache test and clean operations, for Harvard or unified cache implementation. 
This value is: 








0x0 Not supported. 

[23:20] L1Uni Indicates the supported entire L1 cache maintenance operations, for a unified cache implementation. This value 
is: 
0x0 Not supported. 

[19:16] L1Hvd Indicates the supported entire L1 cache maintenance operations, for a Harvard cache implementation. This value 
is: 
0x0 Not supported. 





[15:12] L1UniSW Indicates the supported L1 cache line maintenance operations by set/way, for a unified cache implementation. 
This value is: 


0x0 Not supported. 





[11:8] L1HvdSW Indicates the supported L1 cache line maintenance operations by set/way, for a Harvard cache implementation. 
This value is: 


0x0 Not supported. 





[7:4]  L1UniVA Indicates the supported L1 cache line maintenance operations by VA, for a unified cache implementation. This 
value is: 


0x0 Not supported. 





[3:0] L1HvdVA Indicates the supported L1 cache line maintenance operations by VA, for a Harvard cache implementation. This 
value is: 


0x0 Not supported. 





To access the ID_MMFR1_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_MMFR1_EL1; Read AArch32 Memory Model Feature Register 1 





To access the ID MMFRI1 in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c1, 5; Read AArch32 Memory Model Feature Register 1 


4.3.10 AArch32 Memory Model Feature Register 2, EL1 


The ID MMFR2_ ELI characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
of the processor in AArch32. 
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Usage constraints 
The ID MMFR2_ EL1 must be interpreted with: 


+ ID _MMFRO ELI. 
* ID MMFRI ELI. 
e ID MMFR3 ELI. 


The accessibility to the ID MMFR2_ ELI by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID MMFR2_ ELI is: 


e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_MMFR2 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID MMFR2_ EL] bit assignments. 


28 27 24 23 2019 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB | L1HvdRng | L1HvdBG | L1HvdFG 


Figure 4-9 ID_MMFR2_EL1 bit assignments 
The following table shows the ID MMFR2_ EL] bit assignments. 


Table 4-24 ID_MMFR2_EL1 bit assignments 























Bits Name Function 
[31:28] HWAccFlg Indicates support for Hardware Access flag. This value is: 
@x® Not supported. 
[27:24] WFIStall Indicates support for Wait For Interrupt (WFYI) stalling. This value is: 
0x1 Processor supports WFI stalling. 
[23:20] MemBarr Indicates the supported CP15 memory barrier operations. This value is: 
0x2 Processor supports: 
e Data Synchronization Barrier (DSB). 
e Instruction Synchronization Barrier (ISB). 
* Data Memory Barrier (DMB). 
ARM deprecates the use of these CP15 operations. Instead, use the DMB, DSB, and ISB barrier instructions. 
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Table 4-24 ID_MMFR2_EL1 bit assignments (continued) 





Bits Name Function 





[19:16] UniTLB Indicates the supported TLB maintenance operations. This value is: 


0x6 Processor supports: 
e Invalidate all entries in the TLB. 
e Invalidate TLB entry by VA. 
¢ Invalidate TLB entries by ASID match. 
e Invalidate instruction TLB and data TLB entries by VA All ASID. This is a shared unified 
TLB operation. 
¢ Invalidate Hyp mode unified TLB entry by VA. 
e Invalidate entire Non-secure PL1 and PLO unified TLB. 
e Invalidate entire Hyp mode unified TLB. 
¢ Invalidate TLB entry by VA, Last Level. 
¢ Invalidate TLB entry by VA and ASID, Last Level. 
e Invalidate Stage 2 TLB only by IPA. 
e Invalidate Stage 2 TLB only by IPA, Last Level. 





[15:12] HvdTLB Indicates support for Harvard TLB maintenance operations. This value is: 


@x@ Not supported. 





[11:8] LiHvdRng Indicates support for Harvard L1 cache maintenance range operations. This value is: 


@x@ Not supported. 





[7:4] | L1HvdBG Indicates support for Harvard L1 cache background fetch operations. This value is: 
0x0 Not supported. 





[3:0]  L1HvdFG Indicates support for Harvard L1 cache foreground fetch operations. This value is: 
0x0 Not supported. 





To access the ID_MMFR2_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_MMFR2_EL1; Read AArch32 Memory Model Feature Register 2 


To access the ID_MMFR2 in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c0, c1, 6; Read AArch32 Memory Model Feature Register 2 


4.3.11 AArch32 Memory Model Feature Register 3, EL1 


The ID_MMFR3_EL!1 characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
of the processor in AArch32. 
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Usage constraints 
The ID MMFR3_EL1 must be interpreted with: 


+ ID _MMFRO ELI. 
* ID MMFRI ELI. 
e ID MMFR2 ELI. 


The accessibility to the ID MMFR3_ELI by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID MMFR3_ ELI is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_MMEFR3 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID MMFR3_ EL] bit assignments. 


31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





Figure 4-10 ID_MMFR3_EL1 bit assignments 
The following table shows the ID MMFR3_ EL] bit assignments. 


Table 4-25 ID_MMFR3_EL1 bit assignments 
































Bits Name Function 
[31:28] Supersec Indicates support for supersections. This value is: 
0x0 Processor supports supersections. 
[27:24] CMemSz Indicates the physical memory size supported by the processor caches. This value is: 
0x2 Processor caches support 40-bit physical address range. 
[23:20] CohWalk Indicates whether translation table updates require a clean to the point of unification. This value is: 
0x1 Updates to the translation tables do not require a clean to the point of unification to ensure 
visibility by subsequent translation table walks. 
[19:16] - Reserved, RESO. 
[15:12] MaintBest Indicates whether cache, TLB and branch predictor operations are broadcast. This value is: 
0x2 Cache, TLB and branch predictor operations affect structures according to shareability and 
defined behavior of instructions. 
[11:8] BPMaint Indicates the supported branch predictor maintenance operations. This value is: 
0x2 Processor supports: 
e Invalidate all branch predictors. 
e Invalidate branch predictors by VA. 
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Table 4-25 ID_MMFR3_EL1 bit assignments (continued) 





Name Function 





CMaintSW Indicates the supported cache maintenance operations by set/way. This value is: 


0x1 Processor supports: 
e Invalidate data cache by set/way. 
e Clean data cache by set/way. 
e Clean and invalidate data cache by set/way. 





CMaintVA Indicates the supported cache maintenance operations by VA. This value is: 


0x1 Processor supports: 
e Invalidate data cache by VA. 
e Clean data cache by VA. 
e Clean and invalidate data cache by VA. 
e Invalidate Instruction Cache by VA. 
e Invalidate all Instruction Cache entries. 





To access the ID MMFR3_ ELI in AArch64 state, read the register with: 


MRS <Xt>, ID_MMFR3_EL1; Read AArch32 Memory Model Feature Register 3 
To access the ID_ MMFR3 in AArch32 state, read the CP15 register with: 


MRC p15, @, <Rt>, c@, c1, 7; Read AArch32 Memory Model Feature Register 3 


AArch32 Instruction Set Attribute Register 0, EL1 


The ID ISARO_EL1 characteristics are: 


Purpose 

Provides information about the instruction set that the processor supports in AArch32. 
Usage constraints 

The ID ISARO ELI! must be interpreted with: 

e ID_ISARI Ell. 

e ID ISAR2 Ell. 

« ID ISAR3 Ell. 

« ID ISAR4 Ell. 

e ID ISAR5 Ell. 


The accessibility to the ID ISARO_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID_ISARO_EL1 is: 


e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_ISARO register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID ISARO EL]! bit assignments. 
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31 28 27 24 23 20 19 16 15 12 11 8 7 4 3 0 





Figure 4-11 ID_ISARO_EL1 bit assignments 


The following table shows the ID ISARO_ ELI bit assignments. 


Bits Name 


Table 4-26 ID_ISARO_EL1 bit assignments 


Function 





[31:28] - 


Reserved, RESO. 





[27:24] Divide 


Returns @x2 to indicate the processor implements the following divide instructions: 
e SDIV and UDIV in the T32 instruction set. 
¢ SDIV and UDIV in the A32 instruction set. 





[23:20] Debug 


Returns @x1 to indicate the processor implements the BKPT debug instruction. 





[19:16] Coproc 


Returns @x@ to indicate the processor implements no coprocessor instructions, except for separately attributed 
architectures including CP15, CP14, and Advanced SIMD and FP. 





[15:12] CmpBranch 


Returns @x1 to indicate the processor implements the CBNZ and CBZ, Compare and Branch, instructions in the 
T32 instruction set. 





[11:8]  Bitfield 


Returns 0x1 to indicate the processor implements the BFC, BFI, SBFX, and UBFX, bit field instructions. 





[7:4]  BitCount 


Returns @x1 to indicate the processor implements the CLZ bit counting instruction. 





[3:0] Swap 


Returns @x@ to indicate the processor implements no swap instructions in the A32 instruction set. 





To access the ID ISARO_ ELI in AArch64 state, read the register with: 


MRS <Xt>, ID_ISAR@_EL1; Read AArch32 Instruction Set Attribute Register @ 


To access the ID_ISARO in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c2, @; Read AArch32 Instruction Set Attribute Register @ 


4.3.13 AArch32 Instruction Set Attribute Register 1, EL1 


The ID_ISAR1_EL1 characteristics are: 


Purpose 


Provides information about the instruction set that the processor supports in AArch32. 


Usage constraints 


The ID _ISAR1_ ELI! must be interpreted with: 
e ID ISARO ELI. 
e ID ISAR2 ELI. 
e ID _ISAR3 ELI. 
e ID _ISAR4 ELI. 
e ID ISARS5 ELI. 


The accessibility to the ID ISAR1_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 
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Configurations 
The ID_ISAR1_ EL} is: 


¢ Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_ISAR1 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID ISAR1_ ELI bit assignments. 


28 27 24 23 20 19 16 15 12 11 


Figure 4-12 ID_ISAR1_EL1 bit assignments 
The following table shows the ID ISAR1_EL1 bit assignments. 


Table 4-27 ID_ISAR1_EL1 bit assignments 





Bits Name Function 





[31:28] Jazelle Returns 0x1 to indicate the processor implements the BXJ instruction, and the J bit in the PSR. 





[27:24] Interwork Returns 0x3 to indicate the processor implements the following interworking instructions: 
* BX instruction, and the T bit in the PSR. 
e BLX instruction, and PC loads have BX-like behavior. 
e Data-processing instructions in the A32 instruction set with the PC as the destination and the S bit clear have 
BX-like behavior. 





[23:20] Immediate Returns 0x1 to indicate the processor implements the following data-processing instructions with long 
immediates: 
e MOVT instruction. 
e MOV instruction encoding with zero-extended 16-bit immediates. 
¢« Thumb ADD and SUB instruction encoding with zero-extended 12-bit immediates, and other ADD, ADR, and 
SUB encoding cross-referenced by the pseudocode for those encodings. 





[19:16] IfThen Returns @x1 to indicate the processor implements the IT instruction and the IT bits in the PSRs, in the T32 
instruction set. 





[15:12] Extend Returns 0x2 to indicate the processor implements the following Extend instructions: 
e SXTB, SXTH, UXTB, and UXTH instructions. 
e  SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, UXTAB16, and UXTAH instructions. See the ARM® 
Architecture Reference Manual ARMV8 for more information. 





[11:8] Except_AR Returns 0x1 to indicate the processor implements the SRS, RFE, and CPS exception-handling instructions. 





[7:4] Except Returns 0x1 to indicate the processor implements the LDM (exception return), LDM (user registers), and STM 
(user registers) exception-handling instructions in the A32 instruction set. 





[3:0] Endian Returns 0x1 to indicate the processor implements the SETEND instruction, and the E bit in the PSRs. 





To access the ID_ISAR1_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_ISAR1_EL1; Read AArch32 Instruction Set Attribute Register 1 


To access the ID_ISAR1 in AArch32 state, read the CP15 register with: 


MRC p15, @, <Rt>, c@, c2, 1; Read AArch32 Instruction Set Attribute Register 1 
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4.3.14 AArch32 Instruction Set Attribute Register 2, EL1 


The ID ISAR2_ EL] characteristics are: 


Purpose 

Provides information about the instruction set that the processor supports in AArch32. 
Usage constraints 

The ID_ISAR2 must be interpreted with: 

e ID_ISARO Ell. 

e ID_ISARI Ell. 

e ID ISAR3 Ell. 

« ID ISAR4 Ell. 

e ID ISAR5 Ell. 


The accessibility to the ID_ISAR2_EL1 by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID_ISAR2_ EL] is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_ISAR2 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID ISAR2 EL]! bit assignments. 


28 27 24 23 20 19 16 15 12 11 


MultiAccessInt = 


Figure 4-13 ID_ISAR2_EL1 bit assignments 
The following table shows the ID ISAR2_EL1 bit assignments. 


Table 4-28 ID_ISAR2_EL1 bit assignments 











Bits Name Function 
[31:28] Reversal Returns 0x2 to indicate the processor implements the following Reversal instructions: 
e REV, REV16, and REVSH. 
e  RBIT. 
[27:24] PSR_AR Returns 0x1 to indicate the processor implements the following instructions that can manipulate the PSR: 


e Processor supports MRS and MSR instructions, and the exception return forms of data-processing 
instructions. See the ARM” Architecture Reference Manual ARMV8 for more information. 





[23:20] MultU Returns 0x2 to indicate the processor implements the UMULL, UMLAL, and UMAAL unsigned multiply 
instructions. 
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Table 4-28 ID_ISAR2_EL1 bit assignments (continued) 





Bits Name Function 





[19:16] MultS Returns 0x3 to indicate the processor implements the following signed multiply instructions: 

SMULL and SMLAL instructions 

SMLABB, SMLABT, SMLALBB,SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, SMLAWB, SMLAWT, 
SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT instructions, and the Q bit in the PSRs. 
SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, SMMLAR, SMMLS, 
SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX instructions. 





[15:12] Mult Returns 0x2 to indicate the processor implements the MUL, MLA, and MLS multiply instructions. 





[11:8] MultiAccessInt Returns @x@ to indicate no support for interruptible multi-access instructions. This means that the LDM and 


STM instructions are not interruptible. 





[7:4] |MemHint Returns 0x4 to indicate the processor implements the PLD, PLI (NOP), and PLDW memory hint instructions. 





[3:0]  LoadStore Returns 0x2 to indicate the processor implements the following additional load/store instructions and Load- 


Acquire/Store-Release instructions: 
LDRD and STRD load/store instructions. 
STRLB, STRLH, STRL, LDRAB, LDRAH, and LDRA Load-Acquire and Store-Release instructions. 





To access the ID ISAR2_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_ISAR2_EL1; Read AArch32 Instruction Set Attribute Register 2 


To access the ID_ISAR2 in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c2, 2; Read AArch32 Instruction Set Attribute Register 2 


4.3.15 AArch32 Instruction Set Attribute Register 3, EL1 


The ID ISAR3_EL1 characteristics are: 


Purpose 


Provides information about the instruction set that the processor supports in AArch32. 
Usage constraints 
The ID_ISAR3 must be interpreted with: 


ID_ISARO ELI. 
ID_ISAR1 ELI. 
ID_ISAR2 ELI. 
ID_ISAR4 ELI. 
ID_ISARS ELI. 


The accessibility to the ID ISAR3_EL1 by Exception level is: 


Configurations 


The ID_ISAR3_ EL! is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Common to Secure and Non-secure states. 
Architecturally mapped to the AArch32 ID_ISAR3 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_ISAR3_ EL]! bit assignments. 
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28 27 24 23 20 19 16 15 12 11 


ThumbEE | TrueNOP |ThumbCopy} TabBranch yes SIMD 


Figure 4-14 ID_ISAR3_EL1 bit assignments 


The following table shows the ID_ISAR3_EL1 bit assignments. 


Table 4-29 ID_ISAR3_EL1 bit assignments 



































Bits Name Function 
[31:28] ThumbEE Returns @x@ to indicate no support for Thumb Execution Environment (ThumbEE) extension instructions. 
[27:24] TrueNOP Returns 0x1 to indicate the processor implements true NOP instructions in both the A32 and T32 instruction 
sets, and additional NOP-compatible hints. 
[23:20] ThumbCopy Returns @x1 to indicate the processor supports T32 instruction set encoding T1 of the MOV (register) 
instruction, copying from a low register to a low register. 
[19:16] TabBranch Returns @x1 to indicate the processor implements the TBB and TBH table branch instructions in the T32 
instruction set. 
[15:12] SynchPrim This field is used with the SynchPrim_frac field of ID_ISAR4 to indicate the supported Synchronization 
Primitive instructions. This value is: 
0x2 Processor supports: 
e LDREX and STREX instructions. 
e CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
e LDREXD and STREXD instructions. 
[11:8] SVC Returns 0x1 to indicate the processor implements the SVC instruction. 
[7:4] SIMD Returns 0x3 to indicate the processor implements the following Single Instruction Multiple Data (SIMD) 
instructions: 
e  SSAT and USAT instructions, and the Q bit in the PSRs. 
e PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, QSUB8, QSAX, SADD16, SADD8, SASX, SEL, SHADD16, 
SHADD8, SHASX, SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, SSUB8, SSAX, SXTAB16, SXTB16, 
UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, UHSUB16, UHSUB8, UHSAX, UQADD16, UQADD3, 
UQASX, UQSUB16, UQSUB8, UQSAX, USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, UXTB16 
instructions, and the GE[3:0] bits in the PSRs. 
See the ARM® Architecture Reference Manual ARMv8 for more information. 
[3:0] Saturate Returns 0x1 to indicate the processor implements the QADD, QDADD, QDSUB, QSUB saturate instructions and the 
Q bit in the PSRs. 
To access the ID ISAR3_EL1 in AArch64 state, read the register with: 
MRS <Xt>, ID_ISAR3_EL1; Read AArch32 Instruction Set Attribute Register 3 
To access the ID_ISAR3 in AArch32 state, read the CP15 register with: 
MRC p15, ©, <Rt>, c@, c2, 3; Read AArch32 Instruction Set Attribute Register 3 
4.3.16 AArch32 Instruction Set Attribute Register 4, EL1 
The ID ISAR4 EL] characteristics are: 
Purpose 
Provides information about the instruction set that the processor supports in AArch32. 
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Usage constraints 
The ID _ISAR4 EL! must be interpreted with: 
e ID_ISARO ELI. 
e ID ISAR1 Ell. 
e ID ISAR2 Ell. 
e ID ISAR3 Ell. 
e ID ISAR5 Ell. 


The accessibility to the ID_ISAR4_EL1 by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The ID_ISAR4 EL] is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 ID_ISAR4 register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID ISAR4 EL] bit assignments. 
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SynchPrim_frac— 


Figure 4-15 ID_ISAR4_EL1 bit assignments 
The following table shows the ID ISAR4 ELI bit assignments. 


Table 4-30 ID_ISAR4_EL1 bit assignments 











Bits Name Function 
[31:28] SWP_frac Returns @x@ to indicate that SWP or SWPB instructions are not implemented. 
[27:24] PSR _M Returns @x@ to indicate that M-profile instructions, that modify the PSRs, are not implemented. 





[23:20] SynchPrim_frac This field is used with the SynchPrim field of ID ISAR3_ EL! to indicate the supported Synchronization 
Primitive instructions. This value is: 


0x0 Processor supports: 
e LDREX and STREX instructions. 
e CLREX, LDREXB, LDREXH, STREXB, and STREXH instructions. 
¢« LDREXD and STREXD instructions. 





[19:16] Barrier Returns 0x1 to indicate the processor implements the DMB, DSB, and ISB barrier instructions in the A32 and 
T32 instruction sets. 














[15:12] SMCs Returns @x1 to indicate the processor implements the SMC instruction. 
[11:8] | Writeback Returns 0x1 to indicate the processor supports all writeback addressing modes defined in ARMv8 
architecture. 
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Table 4-30 ID_ISAR4_EL1 bit assignments (continued) 





Bits Name Function 





[7:4]  WithShifts Returns @x4 to indicate the processor supports the following instructions with shifts: 
¢ Shifts of loads and stores over the range LSL 0-3. 
e Constant shift options, both on load/store and other instructions. 
e Register-controlled shift options. 


See the ARM” Architecture Reference Manual ARMV8 for more information. 





[3:0]  Unpriv Returns 0x2 to indicate the processor implements the following unprivileged instructions: 
+ LDRBT, LDRT, STRBT, and STRT. 
e LDRHT, LDRSBT, LDRSHT, and STRHT. 





To access the ID ISAR4 ELI in AArch64 state, read the register with: 
MRS <Xt>, ID_ISAR4_EL1; Read AArch32 Instruction Set Attribute Register 4 
To access the ID_ISAR4 in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c2, 4; Read AArch32 Instruction Set Attribute Register 4 


4.3.17 AArch32 Instruction Set Attribute Register 5, EL1 


The ID ISAR5_EL1 characteristics are: 


Purpose 
Provides information about the Cryptography Extension instruction set that the processor can support in 
AArch32. 





Note 


e The optional Cryptography engine is not included in the base product of the processor. ARM requires 
licensees to have contractual rights to obtain the Cortex-A72 Cryptography engine. 

e The SHA1, SHA2, and AES fields of ID_ISAR5_EL1 are @x@ if the Cryptography engine is not 
included or CRYPTODISABLE is tied HIGH. 


Usage constraints 

The ID ISAR5 ELI! must be interpreted with: 
e ID ISARO ELI. 

e ID ISAR1 Ell. 

e ID ISAR2 Ell. 

e ID ISAR3 ELl. 

e ID ISAR4 ELI. 


The accessibility to the ID_ISAR5_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 

The ID_ISAR5_ELl1 is: 

e Common to Secure and Non-secure states. 

e Architecturally mapped to the AArch32 ID_ISARS register. 
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Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 
The following figure shows the ID ISARS EL! bit assignments. 


31 20 19 16 15 12 11 8 


7 4 3 0 


Figure 4-16 ID_ISAR5_EL1 bit assignments 
The following table shows the ID_ISARS_EL1 bit assignments. 


Table 4-31 ID_ISAR5_EL1 bit assignments 





Bits 


Name 


Function 





[31:20] 


Reserved, RESO. 





[19:16] 


CRC32 


Returns @x1 to indicate that CRC32 instructions are implemented in AArch32 state. 





[15:12] 


SHA2 


Indicates whether SHA2 instructions are implemented in AArch32 state. The possible values are: 


@x@ SHA2 instructions are not implemented in AArch32 state. 
@x1 SHA256H, SHA256H2, SHA256SUQ@, and SHA256SU1 instructions are implemented. 


All other values are reserved. 





[11:8] 


SHA1 


Indicates whether SHA1 instructions are implemented in AArch32 state. The possible values are: 


@x@ SHAl1 instructions are not implemented in AArch32 state. 
@x1 SHA1C, SHA1P, SHA1M, SHA1H, SHA1SU@, and SHA1SU1 instructions are implemented. 


All other values are reserved. 





[7:4] 


AES 


Indicates whether AES instructions are implemented in AArch32 state. The possible values are: 


@x@ AFS instructions are not implemented in AArch32 state. 


@x2 AESE, AESD, AESMC, AESIMC, and PMULL/PMULL2 instructions operating on 64-bit data. 


All other values are reserved. 





[3:0] 


SEVL 


Returns @x1 to indicate that the SEVL instruction is implemented in AArch32 state. 





4.3.18 


To access the ID ISAR5_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_ISAR5_EL1; Read AArch32 Instruction Set Attribute Register 5 


To access the ID_ISARS in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c2, 5; Read AArch32 Instruction Set Attribute Register 5 


AArch64 Processor Feature Register 0, EL1 


The ID_AA64PFRO ELI characteristics are: 


Purpose 
Provides information on the exception handling of the processor in AArch64 state. 
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Usage constraints 
The accessibility to the ID AA64PFRO ELI by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The external debug accessibility to ID AA64PFRO_EL1[63:32] and ID_ AA64PFRO_ EL1[31:0] 
by condition code is: 





Off DLK OSLK EDAD SLK Default 





ae = «2 = RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The ID_AA64PFR0 is architecturally mapped as follows: 


e [63:32] to external ID_AA64PFRO[63:32] register. 
e [31:0] to external ID_ AA64PFROJ[31:0] register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_ AA64PFRO_ EL] bit assignments. 
registers 


63 
RESO 
Figure 4-17 ID_AA64PFRO_EL1 bit assignments 


The following table shows the ID_ AA64PFRO_EL! bit assignments. 


28 27 24 23 20 19 16 15 12 11 





Table 4-32 ID_AA64PFRO_EL1 bit assignments 





Bits Name Function 





[63:28] - Reserved, RESO. 





[27:24] GIC system registers Indicates support for the GIC System register interface. The possible values are: 


@x@ No GIC System registers are supported. This is the reset value when GICCDISABLE is tied 




















HIGH. 
@x1 GICv3 System registers are supported. This is the reset value when GICCDISABLE is tied 
LOW. 
[23:20] AdvSIMD Returns @x@ to indicate support for Advanced SIMD. 
[19:16] FP Returns @x@ to indicate support for Floating-point. 
[15:12] EL3 Returns 0x2 to indicate EL3 supports AArch64 state or AArch32 state. 
[11:8] EL2 Returns @x2 to indicate EL2 supports AArch64 state or AArch32 state. 
[7:4] ELI Returns 0x2 to indicate EL1 supports AArch64 state or AArch32 state. 
[3:0] ELO Returns 0x2 to indicate ELO supports AArch64 state or AArch32 state. 





To access the ID_AA64PFR0_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_AA64PFR@_EL1; Read AArch64 Processor Feature Register @ 
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The ID_AA64PFRO[31:0] can be accessed through the memory-mapped interface and the external debug 
interface, offset @xD20. 


The ID_AA64PFRO[63:32] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD24. 


4.3.19 AArch64 Debug Feature Register 0, EL1 


The ID_AA64DFRO_ ELI characteristics are: 


Purpose 

Provides top-level information of the debug system in AArch64 state. 
Usage constraints 

The accessibility to the ID AA64DFRO_ ELI by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The external debug accessibility to the ID_ AA64DFRO0[63:32] and the ID_AA64DFRO0[31:0] by 
condition code is: 


Off DLK OSLK EDAD SLK Default 





so s = = i» BO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The ID_AA64DFRO_ EL] is architecturally mapped as follows: 
e [63:32] to external ID_AA64DFRO[63:32] register. 
e [31:0] to external ID_ AA64DFRO[31:0] register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_ AA64DFRO_ ELI bit assignments. 


63 
RESO 


The following table shows the ID_AA64DFRO_ELI bit assignments. 


32 31 28 27 24 23 20 19 16 15 12 11 


Figure 4-18 ID_AA64DFR0_EL1 bit assignments 





Table 4-33 ID_AA64DFRO_EL1 bit assignments 























Bits Name Function 

[63:32] - Reserved, RESO 

[31:28] CTX_CMPs Returns @x1 to indicate support for two context-aware breakpoints 
[27:24] - Reserved, RESO 

[23:20] WRPs Returns 0x3 to indicate support for four watchpoints 

[19:16] - Reserved, RESO 

[15:12] BRPs Returns x5 to indicate support for six breakpoints 








[11:8] PMUVer Returns 0x1 to indicate that the Performance Monitors (PMUv3) System registers are implemented 
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Table 4-33 ID_AA64DFRO_EL1 bit assignments (continued) 





Bits Name Function 





[7:4] TraceVer Returns @x@ to indicate that the Trace System registers are not implemented 





[3:0] DebugVer Returns @x6 to indicate that the v8-A Debug architecture is implemented 





To access the ID AA64DFRO_ EL] in AArch64 state, read the register with: 


MRS <Xt>, ID_AA64DFR@_EL1; Read AArch64 Debug Feature Register @ 


The ID_AA64DFRO[31:0] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD28. 


The ID_AA64DFRO[63:32] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD2C. 


4.3.20 AArch64 Instruction Set Attribute Register 0, EL1 


The ID_AA64ISARO_ EL] characteristics are: 


Purpose 
Provides information about the Cryptography Extension instruction set that the processor can 
support. 


Note 


e The optional Cryptography engine is not included in the base product of the processor. ARM 
requires licensees to have contractual rights to obtain the Cortex-A72 processor 
Cryptography engine. 

e The SHA1, SHA2, and AES fields of ID AA64ISARO_ ELI are @x@ if the Cryptography 
engine is not included or CRYPTODISABLE is HIGH. 








Usage constraints 
The accessibility to the ID AA64ISARO_ ELI by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The external debug accessibility to the ID AA64ISARO[63:32] and the ID_AA64ISARO[31:0] 
by condition code is: 





Off DLK OSLK EDAD SLK Default 





a6 8. e a “RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 
Configurations 

The ID_AA64ISARO_ EL] is architecturally mapped as follows: 

e [63:32] to external ID AA64ISARO[63:32] register. 

e [31:0] to external ID AA64ISARO[3 1:0] register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID_AA64ISARO_ ELI bit assignments. 
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20 19 16 15 12 11 8 


7 4 3 0 


Figure 4-19 ID_AA64ISARO_EL1 bit assignments 





63 
RESO 


The following table shows the ID_ AA64ISARO_ ELI bit assignments. 





Table 4-34 ID_AA64ISARO_EL1 bit assignments 





Bits Name Function 





[63:20] - Reserved, RESO. 





[19:16] CRC32 Returns @x1 to indicate that CRC32 instructions are implemented in AArch64 state. 





[15:12] SHA2 Indicates whether SHA2 instructions are implemented in AArch64 state. The possible values are: 


@x@ No SHA2 instructions implemented. 
0x1 SHA256H, SHA256H2, SHA256U®, and SHA256U1 instructions implemented. 





[11:8] SHA1 Indicates whether SHA1 instructions are implemented in AArch64 state. The possible values are: 


@x@ No SHAI instructions implemented. 
0x1 SHA1C, SHA1P, SHA1M, SHA1SU@, and SHA1SU1 instructions implemented. 





[7:4] AES Indicates whether AES instructions are implemented in AArch64 state. The possible values are: 


@x@ No AES instructions implemented. 


@x2 AESE, AESD, AESMC, AESIMC and PMULL/PMULL2 instructions implemented. 





[3:0] - Reserved, RESO. 





To access the ID AA64ISARO_EL1 in AArch64 state, read the register with: 


MRS <Xt>, ID_AA64ISAR@_EL1; Read AArch64 Instruction Set Attribute Register @ 


The ID_AA64ISARO[31:0] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD30. 


The ID_AA64ISARO[63:32] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD34. 


4.3.21 AArch64 Memory Model Feature Register 0, EL1 


The ID AA64MMFRO ELI characteristics are: 


Purpose 
Provides information about the implemented memory model and memory management support 
in AArch64 state. 
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Usage constraints 
The accessibility of the ID AA64MMFRO_ EL! by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The external debug accessibility to the ID AA64MMFRO[63:32] and the 
ID_AA64MMFROJ[31:0] by condition code is: 





Off DLK OSLK EDAD SLK Default 





a =. = = RO 





Table 10-1 External register access conditions on page 10-347 describes the condition codes. 


Configurations 
The ID AA64MMFRO_ ELI is architecturally mapped as follows: 
e [63:32] to external ID AA64MMFRO[63:32] register. 
e [31:0] to external ID AA64MMFROJ[31:0] register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the ID AA64MMFRO_ELI bit assignments. 


32 31 28 27 24 23 20 19 16 15 12 11 
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| RESO je | 64KB 16KB SNSMem BigEnd ASIDBits | PARange 





Figure 4-20 ID_AA64MMFRO_EL1 bit assignments 
The following table shows the ID AA64MMFRO_ EL! bit assignments. 


Table 4-35 ID_AA64MMFR0_EL1 bit assignments 





Bits Name Function 





[63:32] - Reserved, RESO. 





[31:28] 4KB Returns @x@ to indicate that the 4KB granule is supported. 





[27:24] 64KB Returns @x@ to indicate that the 64KB granule is supported. 





[23:20] 16KB Returns @x@ to indicate that the 16KB granule is not supported. 





[19:16] - Reserved, RESO. 








[15:12] SNSMem Returns @x1 to indicate that the processor supports a distinction between Secure and Non-secure memory. 





[11:8] BigEnd Returns @x1 to indicate that the processor supports a mixed-endian configuration. The SCTLR_ELx.EE and 
SCTLR_EL1.EOE bits can be configured. 





[7:4] | ASIDBits Returns @x2 to indicate that the processor supports 16 ASID bits. 





[3:0] | PARange Returns @x4 to indicate that the processor supports a 44-bit physical address range, that is, 16TByte. 





To access the ID AA64MMFRO_ ELI in AArch64 state, read the register with: 
MRS <Xt>, ID_AA64MMFR@_EL1; Read AArch64 Memory Model Feature Register @ 


The ID_ AA64MMFRO[31:0] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD38. 
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The ID_ AA64MMFRO[63:32] can be accessed through the memory-mapped interface and the external 
debug interface, offset @xD3C. 


4.3.22 Cache Size ID Register, EL1 


The CCSIDR_ELI characteristics are: 


Purpose 
Provides information about the architecture of the caches. There is one Cache Size ID Register 
for each cache that the processor can access. CSSELR_EL1 selects which Cache Size ID 
Register is accessible. 

Usage constraints 
The accessibility to the CCSIDR_EL1 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





If CSSELR_EL1 indicates a cache that is not implemented, reading the Cache Size ID Register 
returns an UNKNOWN value. 


Configurations 
The CCSIDR_EL1 is: 


¢ Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 CCSIDR register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the CCSIDR_ELI bit assignments. 


31 30 29 28 27 13 12 3 2 0 


wT LWA 
WB RA 
Figure 4-21 CCSIDR_EL1 bit assignments 


The following table shows the CCSIDR_EL1 bit assignments. 


Table 4-36 CCSIDR_EL1 bit assignments 











Bits Name Function 
[31] WT Returns @b@ to indicate that the cache level does not support Write-Through. 
[30] WB Indicates support for Write-Back. The possible values are: 


0 Cache level does not support Write-Back. 
1 Cache level supports Write-Back. 





[29] RA Returns @b1 to indicate that the cache level supports Read-Allocation. 





[28] WA Indicates support for Write-Allocation. The possible values are: 


0 Cache level does not support Write-Allocation. 
1 Cache level supports Write-Allocation. 





[27:13] NumSets Indicates the (number of sets in cache) — 1. Therefore, a value of 0 indicates 1 set in the cache. The number of 
sets does not have to be a power of 2. 
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Table 4-36 CCSIDR_EL1 bit assignments (continued) 





Bits Name Function 





[12:3] Associativity Indicates the associativity of the selected cache level. The possible values are: 


0b0000000001 2-way. 
0b0000000010 3-way. 
0b0000001111 16-way. 





[2:0]  LineSize Returns @b@10 to indicate that the cache line size is 64 bytes. 





The following table shows the individual bit field and complete register encoding for the CCSIDR_EL1. 
The CSSELR_ELI determines which Cache Size ID Register to select. 


Table 4-37 Encoding of the Cache Size ID Register 





CSSELR_EL1 Size Complete register encoding Register bit field encoding 





WT WB RA WA NumSets Associativity LineSize 























0x0 32KB 0x701FE00A 0 1 1 1 OxOFF 0x1 0x2 
0x1 48KB 0x201FE012 0 0 1 0 OXxOFF 0x2 0x2 
0x2 512KB 0x703FE07A 0 1 1 1 Ox1FF OxF 0x2 
1024KB 0x707FEQ@7A 0 1 1 1 Ox3FF OXF 0x2 
2048KB 0x70FFE07A 0 1 1 1 Ox7FF OXF 0x2 
4096KB 0x71FFE07A 0 1 1 1 OXFFF OXF 0x2 
0x3-0xF - - Reserved 





To access the CCSIDR_EL1 in AArch64 state, read the register with: 
MRS <Xt>, CCSIDR_EL1; Read Cache Size ID Register 
To access the CCSIDR in AArch32 state, read the CP15 register with: 


MRC p15, 1, <Rt>, c0, c@, @; Read Cache Size ID Register 


4.3.23 Cache Level ID Register, EL1 


The CLIDR_EL!1 characteristics are: 

Purpose 
Identifies: 
e The type of cache, or caches, implemented at each level, up to a maximum of seven levels 
e The Level of Coherency and Level of Unification for the cache hierarchy. 


Usage constraints 
The accessibility to the CLIDR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 
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Configurations 
The CLIDR_ELI is: 


e Common to Secure and Non-secure states. 
e A 64-bit register in the AArch64 state. 
e Architecturally mapped to the AArch32 CLIDR register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the CLIDR_EL1 bit assignments. 


633029 2726 2423 2120 1817 1514 1211 


esq touu | toc | LoUIS | Ctype7 | Ctype6 | Ctype5 | Ctype4| Ctype3 | Ctype2| Ctype1 


Figure 4-22 CLIDR_EL1 bit assignments 
The following table shows the CLIDR_EL1 bit assignments. 


Table 4-38 CLIDR_EL1 bit assignments 















































Bits Name Function 
[63:30] - Reserved, RESO. 
[29:27] LoUU Indicates the Level of Unification Uniprocessor for the cache hierarchy. This value is: 
@bee1 L1 cache is the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the point of unification for the processor. 
[26:24] LoC Indicates the Level of Coherency for the cache hierarchy. This value is: 
0be10 L3 cache. 
[23:21] LoUIS Indicates the Level of Unification Inner Shareable for the cache hierarchy. This value is: 
@bee1 L2 cache. 
[20:18] Ctype7 Indicates the type of cache implemented at level 7. This value is: 
ebeee No cache. 
[17:15] Ctype6 Indicates the type of cache implemented at level 6. This value is: 
ebeee No cache. 
[14:12] Ctype5 Indicates the type of cache implemented at level 5. This value is: 
ebeee No cache. 
[11:9] Ctype4 Indicates the type of cache implemented at level 4. This value is: 
ebeee No cache. 
[8:6]  Ctype3 Indicates the type of cache implemented at level 3. This value is: 
ebeee No cache. 
[5:3] Ctype2 Indicates the type of cache implemented at level 2. This value is: 
0b100 Unified cache. 
[2:0]  Ctypel Indicates the type of cache implemented at level 1. This value is: 
Qbe11 Separate instruction and data caches. 
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To access the CLIDR_EL1 in AArch64 state, read the register with: 
MRS <Xt>, CLIDR_EL1; Read Cache Level ID Register 


To access the CLIDR in AArch32 state, read the CP15 register with: 


MRC p15, 1, <Rt>, c@, c@, 1; Read Cache Level ID Register 


4.3.24 Auxiliary ID Register, EL1 


The processor does not implement AIDR_EL1. This register is always RESO. 


4.3.25 Cache Size Selection Register, EL1 


The CSSELR_ELI characteristics are: 
Purpose 
Selects the current CCSIDR_EL1, by specifying: 
e The required cache level. 
e The cache type, either instruction or data cache. 


Usage constraints 
The accessibility to the CSSELR_EL1 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





If the CSSELR_ ELI level field is programmed to a cache level that is not implemented, then a 
read of CSSELR_EL1 returns an uUNKNown value in CSSELR_EL1.Level. 


Configurations 
The CSSELR_ ELl is: 
¢ Banked for the Secure and Non-secure states. 
e Architecturally mapped to the Non-secure AArch32 CSSELR register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the CSSELR_EL1 bit assignments. 


31 4 3 10 
mm ft 
Inb— 


Figure 4-23 CSSELR_EL1 bit assignments 
The following table shows the CSSELR_EL!1 bit assignments. 
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Table 4-39 CSSELR_EL1 bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:1] Level Cache level of required cache: 


Q@beee Level 1. 
@bee1 Level 2. 


All other values are reserved. 





[0] InD Instruction not Data bit: 


0 Data or unified cache. 


1 Instruction cache. 





To access the CSSELR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, CSSELR_EL1; Read Cache Size Selection Register 
MSR CSSELR_EL1, <Xt>; Write Cache Size Selection Register 


To access the CSSELR in AArch32 state, read or write the CP15 register with: 


MRC p15, 2, <Rt>, c@, c@, @; Read Cache Size Selection Register 
MCR p15, 2, <Rt>, c@, c0, @; Write Cache Size Selection Register 


Related information 
4.3.22 Cache Size ID Register, ELI on page 4-117. 


4.3.26 Cache Type Register, ELO 


The CTR_ELO characteristics are: 


Purpose 
Provides information about the architecture of the caches. 
Usage constraints 
The accessibility to the CTR_ELO in AArch64 state by Exception level is: 





ELO EL4(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





Config RO RO RO RO RO 





The accessibility to the CTR in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations 
The CTR_ELO is: 


e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch32 CTR register. 


Attributes 
See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 


The following figure shows the CTR_ELO bit assignments. 
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31 30 28 27 24 23 20 19 16 15 14 13 4 3 0 
LRes1 


Figure 4-24 CTR_ELO bit assignments 
The following table shows the CTR_ELO bit assignments. 


Table 4-40 CTR_ELO bit assignments 





Bits Name 


Function 





BI] - 


Reserved, RES1. 











[30:28] - Reserved, RESO. 

[27:24] CWG Cache Writeback Granule. Log, of the number of words of the maximum size of memory that can be overwritten 
as a result of the eviction of a cache entry that has had a memory location in it modified. This value is: 
0x4 Cache writeback granule size is 16 words. 

[23:20] ERG Exclusives Reservation Granule. Logz of the number of words of the maximum size of the reservation granule 


that has been implemented for the Load-Exclusive and Store-Exclusive instructions. This value is: 


0x4 Exclusive reservation granule size is 16 words. 





[19:16] DminLine Log, of the number of words in the smallest cache line of all the data and unified caches that the processor 


controls. This value is: 


0x4 Smallest data cache line size is 16 words. 





[15:14] Lip 


Level 1 Instruction Cache policy. Indicates the indexing and tagging policy for the L1 Instruction Cache. This 
value is: 


@b11 Physical index, physical tag (PIPT). 





[13:4] - 


Reserved, RESO. 





[3:0] IminLine 


Log» of the number of words in the smallest cache line of all the Instruction Caches that the processor controls. 
This values is: 


0x4 Smallest Instruction Cache line size is 16 words. 





To access the CTR_ELO in AArch64 state, read the register with: 


MRS <Xt>, CTR_EL@; Read Cache Type Register 


To access the CTR in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c@, 1; Read Cache Type Register 


4.3.27 Data Cache Zero ID, ELO 


The DCZID_ELO characteristics are: 


Purpose 
Indicates the block size written with byte values of 0 by the DC ZVA, Data Cache Zero by 
Address, system instruction. 
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Usage constraints 
The accessibility of the DCZID_ELO by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 








RO RO RO RO RO RO 
Configurations 
The DCZID_ELO is a 32-bit register. 
Attributes 


See the register summary in Table 4-1 AArch64 identification registers on page 4-75. 
The following figure shows the DCZID_ELO bit assignments. 


63 





BlockSize 


DZP — 


Figure 4-25 DCZID_ELO bit assignments 
The following table shows the DCZID_ELO bit assignments. 


Table 4-41 DCZID_ELO bit assignments 





Bits Name Function 





[63:5] - Reserved, RESO. 





[4] DZP Prohibit the DC ZVA instruction. The possible values are: 
0 DC ZVA instruction permitted. This is the reset value. 


1 DC ZVA instruction prohibited. 





[3:0] BS Returns @x4 to indicate that the block size is 16 words. 





To access the DCZID_ELO in AArch64 state, read or write the register with: 


MRS <Xt>, DCZID_EL@; Read Data Cache Zero ID Register 


4.3.28 Virtualization Processor ID Register, EL2 


The VPIDR_EL2 characteristics are: 


Purpose 
Holds the value of the Virtualization Processor ID. A Non-secure read of the MIDR from EL1 
returns the value of this register. 
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Usage constraints 
The accessibility to the VPIDR_EL2 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- - - RW RW RW 





The accessibility to the VPIDR in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations 
The VPIDR_EL2 is: 


¢ A Banked EL2 register. 
e Architecturally mapped to the AArch32 VPIDR register. 


Attributes 
See the register summary in Table 4-13 AArch64 virtualization registers on page 4-83. 


The following figure shows the VPIDR_EL2 bit assignments. 


31 0 


VPIDR 


Figure 4-26 VPIDR_EL2 bit assignments 
The following table shows the VPIDR_EL2 bit assignments. 


Table 4-42 VPIDR_EL2 bit assignments 





Bits Name Function 





[31:0] VPIDR MIDR value returned by Non-secure EL! reads of the MIDR. For information on the subdivision of this value, see 
4.3.1 Main ID Register, EL] on page 4-89. 





To access the VPIDR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, VPIDR_EL1; Read Virtualization Processor ID Register 
MSR VPIDR_EL1, <Xt>; Write Virtualization Processor ID Register 


To access the VPIDR, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c@, c@, @; Read Virtualization Processor ID Register 
MCR p15, 4, <Rt>, c@, c@, @; Write Virtualization Processor ID Register 


Related information 
4.3.1 Main ID Register, EL1 on page 4-89. 


4.3.29 Virtualization Multiprocessor ID Register, EL2 


The VMPIDR_EL2 characteristics are: 


Purpose 
Holds the value of the Virtualization Multiprocessor ID. This is the value returned by Non- 
secure ELI reads of MPIDR_ ELI. 
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Usage constraints 
The accessibility of the VMPIDR_EL2 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 








= 2 - RW RW RW 
Configurations 
The VMPIDR EL2 is Architecturally mapped to the Non-secure AArch32 VMPIDR register. 
Attributes 


See the register summary in Table 4-13 AArch64 virtualization registers on page 4-83. 
The following figure shows the VMPIDR_EL2 bit assignments. 
63 32 31 0 


Reserved VMPIDR_EL2 


Figure 4-27 VMPIDR_EL2 bit assignments 
The following table shows the VMPIDR_EL2 bit assignments. 


Table 4-43 VMPIDR_EL2 bit assignments 





Bits Name Function 





[63:32] - Reserved, RESO. 





[31:0] VMPIDR_EL2 MPIDR value returned by Non-secure EL1 reads of the MPIDR_EL1. For information on the subdivision of 
this value, see 4.5.3 Multiprocessor Affinity Register on page 4-240. 





To access the VMPIDR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, VMPIDR_EL1; Read Virtualization Multiprocessor ID Register 
MSR VMPIDR_EL1, <Xt>; Write Virtualization Multiprocessor ID Register 


Related information 
4.5.4 Virtualization Multiprocessor ID Register on page 4-241. 


4.3.30 System Control Register, EL1 


The SCTLR_ELI characteristics are: 


Purpose 

Provides top-level control of the system, including its memory system at EL1 in AArch6é4 state. 
Usage constraints 

The accessibility of the SCTLR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 


- RW RW RW RW RW 





Configurations 
The SCTLR_EL1 is: 


e A 32-bit register in AArch64 state. 
e Architecturally mapped to the Non-secure AArch32 SCTLR register. 


Attributes 
See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 


The following figure shows the SCTLR_EL1 bit assignments. 
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31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211 10 9 8 76543210 





RESO— RESO— LSA 
UCI RES1 SAO 
WXN CP15BEN 


EE 
EOE nTWE THEE 
RESO ITD 
nTWI SED 
UCT _UMA 
DZE——_—_—_1 -—_ RESO 
RESO RES1 


























Figure 4-28 SCTLR_EL1 bit assignments 


The following table shows the SCTLR_EL1bit assignments. 


Table 4-44 SCTLR_EL1 bit assignments 





Function 
































[31:30] - Reserved, RESO. 
[29:28] - Reserved, RES1. 
[27] - Reserved, RESO. 
[26] UCI Enables ELO access to the DC CVAU, DC CIVAC, DC CVAC and IC IVAU instructions in AArch64 state. The 
values are: 
0 ELO access disabled. This is the reset value. 
1 ELO access enabled. 
[25] EE Exception endianness. Indicates the endianness of the translation table data for the translation table lookups. The 
EE bit is permitted to be cached in a TLB. The values are: 
0 Little-endian. 
1 Big-endian. 
[24] EOE Endianness of explicit data access at ELO. The values are: 
0 Explicit data accesses at ELO are little-endian. This is reset value. 
1 Explicit data accesses at ELO are big-endian. 
[23:22] - Reserved, RES1. 
[21] - Reserved, RESO. 
[20] - Reserved, RES1. 
[19] WXN Write permission implies Execute Never (XN). You can use this bit to require all memory regions with write 


permissions are treated as XN. The WXN bit is permitted to be cached in a TLB. The values are: 


0 Regions with write permission are not forced to be XN. This is the reset value. 


1 Regions with write permissions are forced to be XN. 
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Table 4-44 SCTLR_EL1 bit assignments (continued) 









































Bits Name Function 
[18] nTWE WFE non-trapping. The values are: 

0 A WFE instruction executed at ELO that causes suspended execution as if the event register is 
not set and there is no pending WFE wake-up event, is treated as an exception with error code 
of 0x1. 

1 WFE instructions executed as normal. This is the reset value. 

Conditional WFE instructions that fail their condition do not cause an exception if this bit is 0. 

[17] - Reserved, RESO. 
[16] nTWI WFI non-trapping. The values are: 

0 A WFT instruction executed at ELO that causes suspended execution as if there is no pending 
WFI wake-up event, is treated as an exception with error code of 0x1. 

1 WFTI instructions executed as normal. This is the reset value. 

Conditional WFI instructions that fail their condition do not cause an exception if this bit is 0. 

[15] UCT Enables ELO access to the CTR_ELO register in AArch64 state. The values are: 
0 Disables ELO access to the CTR_ELO register. This is the reset value. 
1 Enables ELO access to the CTR_ELO register. 

[14] DZE Enables access to the DC ZVA instruction at ELO. The values are: 

0 Disables execution access to the DC ZVA instruction at ELO. Access is treated as UNDEFINED. 
This is the reset value. 

1 Enables execution access to the DC ZVA instruction at ELO. 

[13] - Reserved, RESO. 
[12] I Instruction cache enable. The values are: 
0 Instruction caches disabled. This is the reset value. 
1 Instruction caches enabled. 
[11] - Reserved, RES1. 
[10] - Reserved, RESO. 
[9] UMA User Mask Access. Controls access to interrupt masks from ELO, when ELO is using AArch64. The values are: 
0 Disables access to the interrupt masks from ELO. 
1 Enables access to the interrupt masks from ELO. 
[8] SED SETEND instruction disable. The values are: 

0 The SETEND instruction is enabled. This is the reset value. 

1 The SETEND instruction is UNALLOCATED. 
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Table 4-44 SCTLR_EL1 bit assignments (continued) 



































Bits Name Function 
[7] ITD IT instruction disable. The values are: 
0 The IT instruction functionality is enabled. This is the reset value. 
1 All encodings of the IT instruction are UNDEFINED when either: 
e hw[3:0] are not equal to @b1000. 
¢ IT instructions with a subsequent 32-bit instruction. 
¢ Subsequent PC reading or writing instruction. 
[6] THEE ThumbEE enable: 
0 ThumbEE is not implemented. 

[5] CP15BEN AArch32 CP15 barrier enable. The values are: 

0 CP15 barrier operations disabled. Their encodings are UNDEFINED. 
1 CP15 barrier operations enabled. This is the reset value. 

[4] SAO Enable ELO Stack Alignment check. When set, use of the Stack Pointer as the base address in a load/store 
instruction at ELO must align to a 16-byte boundary, or a Stack Alignment Fault exception is raised. The values 
are: 

0 Disable ELO Stack Alignment check. 
1 Enable ELO Stack Alignment check. This is the reset value. 

[3] SA Enable Stack Alignment check. When set, use of the Stack Pointer as the base address in a load/store instruction 
at the Exception level of this register must align to a 16-byte boundary, or a Stack Alignment Fault exception is 
raised. The values are: 
0 Disable Stack Alignment check. 
1 Enable Stack Alignment check. This is the reset value. 

[2] C Cache enable. The values are: 
0 Data and unified caches disabled. This is the reset value. 
1 Data and unified caches enabled. 

[1] A Alignment check enable. The values are: 
0 Alignment fault checking disabled. This is the reset value. 
1 Alignment fault checking enabled. 

[0] M MMU enable. The values are: 

0 EL1 and ELO stage 1 MMU disabled. This is the reset value. 
1 EL1 and ELO stage 1 MMU enabled. 

To access SCTLR_EL1 in AArch64 state, read or write the register with: 
MRS <Xt>, SCTLR_EL1; Read EL1 System Control Register 
MSR SCTLR_EL1, <Xt>; Write EL1 System Control Register 

Related information 

4.5.5 System Control Register on page 4-242. 
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4.3.31 Auxiliary Control Register, EL1 


The processor does not implement the ACTLR_ELI register. This register is always RESO. 


4.3.32 Architectural Feature Access Control Register, EL1 


The CPACR_ELI characteristics are: 


Purpose 
Controls access to trace functionality and access to registers associated with Floating-point and 
Advanced SIMD execution. 

Usage constraints 
The accessibility of the CPACR_EL1 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Configurations 
The CPACR_ ELI! is: 


e A32-bit register in AArch64 state. 
e Architecturally mapped to the Non-secure AArch32 CPACR register. 


Attributes 
See the register summary in Table 4-4 AArch64 other System registers on page 4-79. 


The following figure shows the CPACR_EL1 bit assignments. 


31 29 28 27 22 21 2019 0 
LTTA 


Figure 4-29 CPACR_EL1 bit assignments 
The following table shows the CPACR_EL1 bit assignments. 


Table 4-45 CPACR_EL1 bit assignments 





Bits Name Function 





[31:29] - Reserved, RESO. 





[28] TTA Traps trace functionality to EL1 when executing from ELO or EL1. The value is: 


0 System register access to trace functionality is not supported. This bit is RESO. 





[27:22] - Reserved, RESO. 





[21:20] FPEN Traps instructions that access registers associated with floating-point and SIMD execution to trap to EL1 when 
executed from ELO or EL1. The possible values are: 


@bee@ Trap any instruction in ELO or EL! that use registers associated with floating-point and Advanced SIMD 
@b1@ execution. The reset value is @b@. 


@b@1_ Trap any instruction in ELO that use registers associated with floating-point and Advanced SIMD execution. 
Instructions in EL1 are not trapped. 


@b11 No instructions are trapped. 





[19:0] - Reserved, RESO. 








ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 4-129 
Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


To access the CPACR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, CPACR_EL1; Read EL1 Architectural Feature Access Control Register 
MSR CPACR_EL1, <Xt>; Write EL1 Architectural Feature Access Control Register 


Related information 
4.5.6 Architectural Feature Access Control Register on page 4-247. 


4.3.33 Auxiliary Control Register, EL2 


The ACTLR_EL2 characteristics are: 


Purpose 


Controls access to IMPLEMENTATION DEFINED registers in Non-secure EL1. 
Usage constraints 


The accessibility to ACTLR_EL2 in AArch64 state by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 


- - - RW RW RW 





The accessibility to the HACTLR in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 


- - - RW RW - 





Configurations 
The ACTLR_EL2? is: 
¢ A Banked EL2 register. 
e Architecturally mapped to the AArch32 HACTLR register. 


Attributes 
See the register summary in Table 4-4 AArch64 other System registers on page 4-79. 


The following figure shows the ACTLR_EL2 bit assignments. 


31 76543 2 1 0 


L2ACTLR access control S 
L2ECTLR access control 


L2CTLR access control 
Reserved 


CPUECTLR access control 
CPUACTLR access control 





Figure 4-30 ACTLR_EL2 bit assignments 
The following table shows the ACTLR_EL2 bit assignments. 
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Table 4-46 ACTLR_EL2 bit assignments 





Bits Name Function 





[31:7] - Reserved, RESO. 





[6] L2ACTLR access control L2ACTLR access control. The possible values are: 


0 The register is not accessible from Non-secure EL1. 


1 The register is accessible from Non-secure EL1. 





[5] L2ECTLR access control L2ECTLR access control. The possible values are: 


0 The register is not accessible from Non-secure EL1. 


1 The register is accessible from Non-secure EL1. 





[4] L2CTLR access control L2CTLR access control. The possible values are: 


0 The register is not accessible from Non-secure EL1. 


1 The register is accessible from Non-secure EL1. 





[3:2] - Reserved, RESO. 





[1] CPUECTLR access control CPUECTLR access control. The possible values are: 


0 The register is not accessible from Non-secure EL1. 


1 The register is accessible from Non-secure EL1. 





[0] CPUACTLR access control CPUACTLR access control. The possible values are: 


0 The register is not accessible from Non-secure EL1. 


1 The register is accessible from Non-secure EL1. 





To access the ACTLR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, ACTLR_EL2; Read EL2 Auxiliary Control Register 
MSR ACTLR_EL2, <Xt>; Write EL2 Auxiliary Control Register 


To access the HACTLR in AArch32 state, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c1, c@, 1; Read Hypervisor Auxiliary Control Register 
MCR p15, 4, <Rt>, c1, c@, 1; Write Hypervisor Auxiliary Control Register 


4.3.34 Hypervisor Configuration Register, EL2 


The HCR_EL2 characteristics are: 


Purpose 
Provides configuration control for virtualization, including whether various Non-secure 
operations are trapped to EL2. 

Usage constraints 
The accessibility of the HCR_EL2 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW RW 





Configurations 
The HCR_EL2 is architecturally mapped as follows: 
e [63:32] to the AArch32 HCR2 register. 
e [31:0] to the AArch32 HCR register. 
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Attributes 
See the register summary in Table 4-13 AArch64 virtualization registers on page 4-83. 


The following figure shows the HCR_EL2 bit assignments. 
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Figure 4-31 HCR_EL2 bit assignments 


The following table shows the HCR_EL2 bit assignments. 


Table 4-47 HCR_EL2 bit assignments 





Bits Name Function 





[63:34] - Reserved, RESO. 





[33] ID Disables stage 2 Instruction Cache. When HCR_EL2.VM is 1, this forces all stage 2 translations for instruction 


accesses to Normal memory to be Non-cacheable for the EL1/EL0 translation regimes. The values are: 


0 Has no effect on stage 2 EL1/ELO translation regime for instruction accesses. This is the reset 
value. 
1 Forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable 


for the EL1/ELO translation regime. 





[32] CD Disables stage 2 data cache. When HCR_EL2.VM is 1, this forces all stage 2 translations for data accesses and 
translation table walks to Normal memory to be Non-cacheable for the EL1/EL0 translation regimes. The values are: 





0 Has no effect on stage 2 EL1/ELO translation regime for data access or translation table walks. 
This is the reset value. 
1 Forces all stage 2 translations for data accesses and translation table walks to Normal memory to 
be Non-cacheable for the EL1/EL0 translation regime. 
[31] RW Register width control for lower Exception levels. The values are: 
0 Lower levels are all AArch32. This is the reset value. 
1 EL1 is AArch64. ELO is determined by the register width described in the current processing 


state when executing at ELO. 
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Table 4-47 HCR_EL2 bit assignments (continued) 





Bits Name Function 


[30] TRVM Trap Read of Virtual Memory controls. When 1, this causes reads to the EL1 virtual memory control registers from 
EL] to be trapped to EL2. This covers the following registers: 


AArch32 SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR/ 
MAIRO, NMRR/MAIR1, AMAIRO, AMAIR1, and CONTEXTIDR. 
AArch64 SCTLR_EL1, TTBRO_EL1, TTBR1 EL1, TCR_EL1, ESR _EL1, FAR EL1, AFSRO ELI, 


AFSR1_EL1, MAIR _EL1, AMAIR EL1, and CONTEXTIDR_EL1. 


The reset value is 0. 





[29] HCD Disables Hyp call. The processor implements EL3. This bit is RESO. 





[28] TDZ Traps DC ZVA instruction. The values are: 


0 DC ZVA instruction is not trapped. 
1 DC ZVA instruction is trapped to EL2 when executed in Non-secure EL1 or ELO. 





[27] TGE Traps general exceptions. If this bit is set, and SCR_EL3.NS is set, then: 

¢ All EL] exceptions are routed to EL2. 

e For EL1, the SCTLR_EL1.M bit is treated as 0 regardless of its actual state other than the purpose of reading the 
bit. 

e The HCR_EL2.FMO, HCR_EL2.IMO, and HCR_AMO bits are treated as 1 regardless of their actual state other 
than for the purpose of reading the bits. 

e All virtual interrupts are disabled. 

e Any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts are disabled. 

e An exception return to EL] is treated as an illegal exception return. 





[26] TVM Trap Virtual Memory controls. When 1, this causes writes to the EL1 virtual memory control registers from EL1 to 
be trapped to EL2. This covers the following registers: 


AArch32 SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR/ 
MAIRO, NMRR/MAIR1, AMAIRO, AMAIR1, and CONTEXTIDR. 
AArch64 SCTLR_EL1, TTBRO_EL1, TTBR1 EL1, TCR_EL1, ESR _EL1, FAR EL1, AFSRO_EL1, 


AFSR1_EL1, MAIR _EL1, AMAIR EL1, and CONTEXTIDR_EL1. 


The reset value is 0. 





[25] TTLB Trap TLB maintenance instructions. When 1, this causes TLB maintenance instructions executed from EL1 that are 
not UNDEFINED to be trapped to EL2. This covers the following instructions: 


AArch32 TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAATS, ITLBIALL, DTLBIALL, TLBIALL, 
ITLBIMVA, DTLBIMVA, TLBIMVA, ITLBIASID, DTLBIASID, TLBIASID, TLBIMVAA, 
TLBIMVALIS, TLBIMVAALIS, TLBIMVAL, and TLBIMVAAL. 


AArch64 TLBI VAMLLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1, TLBI VAALE1, 
TLBI VMALLE1IS, TLBI VAE1IS, TLBI ASIDE11IS, TLBI VAAE1IS, TLBI VALE1IS, and 
TLBI VAALE1IS. 


The reset value is 0. 








ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 4-133 
Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


Table 4-47 HCR_EL2 bit assignments (continued) 


























Bits Name Function 

[24] TPU Trap Cache maintenance instructions to Point of Unification. When 1, this causes Cache maintenance instructions to 
the point of unification executed from EL1 or ELO that are not UNDEFINED to be trapped to EL2. This covers the 
following instructions: 

AArch32 ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU. 
AArch64 IC IVAU, IC IALLU, IC IALLUIS, and DC CVAU. 
The reset value is 0. 

[23] TPC Trap Data/Unified Cache maintenance operations to point of coherency. When 1, this causes Data or Unified Cache 
maintenance instructions by address to the point of coherency executed from EL1 or ELO that are not UNDEFINED to 
be trapped to EL2. This covers the following instructions: 

AArch32 DCIMVAC, DCCIMVAC, and DCCMVAC. 
AArch64 DC IVAC,DC CIVAC, and DC CVCA. 
The reset value is 0. 

[22] TSW Trap Data/Unified Cache maintenance operations by Set/Way. When 1, this causes Data or Unified Cache 
maintenance instructions by set/way executed from EL1 that are not UNDEFINED to be trapped to EL2. This covers 
the following instructions: 

AArch32 DCISW, DCCSW, and DCCISW. 
AArch64 DC ISW,DC CSW, and DC CISW. 
The reset value is 0. 
[21] TACR Traps Auxiliary Control registers. The values are: 
0 Accesses to the Auxiliary Control registers are not trapped. 
1 Accesses to the ACTLR in AArch32 state or the ACTLR_EL1 in AArch64 state from EL1 are 
trapped to EL2. 

[20] TIDCP Trap Implementation Dependent functionality. When 1, this causes accesses to the following instruction set space 
executed from EL1 to be trapped to EL2: 

AArch32 All CP15 MCR and MRC instructions as follows: 
e CRn is 9, opl is 0 to 7, CRm is c0, cl, c2, c5, c6, c7, or c8, and op2 is 0 to 7. 
e CRn is 10, opl is 0 to 7, CRm is c0, cl, c4, or c8, and op2 is 0 to 7. 
e CRnis 11, opl is 0 to 7, CRm is c0 to c8, or c15, and op2 is 0 to 7. 

AArch64 Reserved control space for IMPLEMENTATION DEFINED functionality. 

Accesses from ELO are UNDEFINED. The reset value is 0. 

[19] TSC Traps SMC instruction. The values are: 
0 SMC instruction is not trapped. 
1 SMC instruction executed in EL1 is trapped to EL2 for AArch32 and AArch64 states. 
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Table 4-47 HCR_EL2 bit assignments (continued) 



































Bits Name Function 
[18] TID3 Trap ID Group 3. When 1, this causes reads to the following registers executed from EL1 to be trapped to EL2: 
AArch32 ID_PFRO, ID_PFR1, ID_DFRO, ID_AFRO, ID MMFRO, ID_MMEFR1, ID _MMFR2, 
ID_MMER3, ID_ISARO, ID_ISAR1, ID_ISAR2, ID _ISAR3, ID_ISAR4, ID_ISAR5, MVFRO, 
MVERI, and MVFR2 and MRC instructions to the following locations: 
e opl is 0, CRn is 0, CRm is c3, c4, c5, c6, or c7, and op2 is 0 or 1. 
e opl is 0, CRn is 0, CRm is c3, and op2 is 2. 
e opl is 0, CRn is 0, CRm is 5, and op2 is 4 or 5. 
AArch64 ID_PFRO_EL1, ID_PFR1_EL1, ID _DFRO_EL1, ID AFRO EL1, ID MMFRO ELI, 
ID_MMFRI EL1, ID MMFR2 EL1, ID MMFR3 EL1,ID ISARO EL1,ID_ISARI ELI, 
ID_ISAR2_EL1, ID ISAR3 EL1, ID ISAR4 EL1, ID ISARS EL1, MVFRO_EL1, 
MVFRI1_ ELI, MVFR2_EL1, ID AA64PFRn EL1, ID AA64DFRn ELI, 
ID_AA64ISARn EL1, ID AA64MMFRn ELI, and ID_AA64AFRn ELI. 
The reset value is 0. 
[17] TID2 Trap ID Group 2. When 1, this causes reads or writes to CSSELR/CSSELR_EL1, to the following registers executed 
from EL1 or ELO that are UNDEFINED to be trapped to EL2: 
AArch32 CTR, CCSIDR, CLIDR, and CSSELR. 
AArch64 CTR_ELO, CCSIDR_EL1, CLIDR_EL1, and CSSELR_EL1. 
The reset value is 0. 
[16] TID1 Trap ID Group 1. When 1, this causes reads to the following registers executed from EL1 to be trapped to EL2: 
AArch32 TCMTR, TLBTR, AIDR, and REVIDR. 
AArch64 AIDR_EL1, and REVIDR_EL1. 
The reset value is 0. 
[15] TIDO Trap ID Group 0. When 1, this causes reads to the following registers executed from EL1 or ELO that are UNDEFINED 
to be trapped to EL2: 
AArch32 FPSID and JIDR. 
AArch64 None. 
The reset value is 0. 
[14] TWE Traps WFE instruction if it would cause suspension of execution. For example, if there is no pending WFE event: 
0 WFE instruction is not trapped. 
1 WFE instruction executed in EL1 or ELO is trapped to EL2 for AArch32 and AArch64 states. 
[13] TWI Traps WFT instruction if it would cause suspension of execution. For example, if there is no pending WFI event: 
0 WFT instruction is not trapped. 
1 WFI instruction executed in EL1 or ELO is trapped to EL2 for AArch32 and AArch64 states. 
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Table 4-47 HCR_EL2 bit assignments (continued) 





Bits Name 


Function 























[12] DC Default Cacheable. When this bit is set to 1 the memory type and attributes determined by stage 1 translation is 
Normal, Non-shareable, Inner Write-Back Write-Allocate, Outer Write-Back Write-Allocate. 
When executing in Non-secure ELO or EL1 and the HCR_EL2.DC bit is set, the behavior of processor is consistent 
with the behavior when: 
e The SCTLR_EL1.M bit is clear, regardless of the actual value of the SCTLR.M bit. 
— An explicit read of the SCTLR_EL1.M bit returns its actual value. 
e The HCR_EL2.VM bit is set, regardless of the actual value of the HCR_EL2.VM bit. 
— Anexplicit read of the HCR_EL2.VM bit returns its actual value. 
The reset value is 0. 
[11:10] BSU Barrier shareability upgrade. Determines the minimum shareability domain that is supplied to any barrier executed 
from EL1 or ELO. The values are: 
e@bee No effect. 
Qbe1 Inner Shareable. 
0b10 Outer Shareable. 
@b11 Full system. 
This value is combined with the specified level of the barrier held in its instruction, according to the algorithm for 
combining shareability attributes. 
[9] FB Force broadcast. When 1, this causes the following instructions to be broadcast within the Inner Shareable domain 
when executed from Non-secure ELI: 
AArch32 ITLBIALL, DTLBIALL, TLBIALL, ITLBIMVA, DTLBIMVA, TLBIMVA, ITLBIASID, DTLBIASID, 
TLBIASID, TLBIMVAA, BPIALL, and ICIALLU. 
AArch64 TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1, TLBI VAALE1, 
and IC IALLU. 
The reset value is 0. 
[8] VSE Virtual System Error/Asynchronous Abort. The values are: 
0 Virtual System Error/Asynchronous Abort is not pending by this mechanism. 
1 Virtual System Error/Asynchronous Abort is pending by this mechanism. 
The virtual System Error/Asynchronous Abort is only enabled when the HCR_EL2.AMO bit is set. 
[7] VI Virtual IRQ interrupt. The values are: 
0 Virtual IRQ is not pending by this mechanism. 
1 Virtual IRQ is pending by this mechanism. 
The virtual IRQ is only enabled when the HCR_EL2.IMO bit is set. 
[6] VF Virtual FIQ interrupt. The values are: 
0 Virtual FIQ is not pending by this mechanism. 
1 Virtual FIQ is pending by this mechanism. 
The virtual FIQ is only enabled when the HCR_EL2.FMO bit is set. 
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Table 4-47 HCR_EL2 bit assignments (continued) 





Bits 


Name 


Function 





[5] 


AMO 


Asynchronous abort and error interrupt routing. The values are: 
0 Asynchronous external Aborts and SError Interrupts while executing at Exception levels lower 
than EL2 are not taken at EL2. Virtual System Error/Asynchronous Abort is disabled. 


1 Asynchronous external Aborts and SError Interrupts while executing at EL2 or lower are taken 
in EL2 unless routed by SCTLR_EL3.EA bit to EL3. Virtual System Error/Asynchronous Abort 
is enabled. 





IMO 


Physical IRQ routing. The values are: 


0 Physical IRQ while executing at Exception levels lower than EL2 are not taken at EL2. Virtual 
IRQ interrupt is disabled. 


1 Physical IRQ while executing at EL2 or lower are taken in EL2 unless routed by 
SCTLR_EL3.IRQ bit to EL3. Virtual IRQ interrupt is enabled. 





FMO 


Physical FIQ routing. The values are: 


0 Physical FIQ while executing at Exception levels lower than EL2 are not taken at EL2. Virtual 
FIQ interrupt is disabled. 


1 Physical FIQ while executing at EL2 or lower are taken in EL2 unless routed by 
SCTLR_EL3.FIQ bit to EL3. Virtual FIQ interrupt is enabled. 





[2] 


PTW 


Protected Table Walk. When this bit is set, if stage 2 translation of a translation table access, made as part of a stage 
1 translation table walk at ELO or EL1, maps to Strongly-ordered or Device memory, the access is faulted as a stage 
2 Permission fault. 





SWIO 


Set/Way Invalidation Override. EL1 execution of the data cache invalidate by set/way instruction is treated as data 
cache clean and invalidate by set/way. When this bit is set: 

e DCISW is treated as DCCISW when in AArch32 state 

e DC ISWis treated as DC CISW when in AArch64 state. 





[0] 


VM 


Enables second stage of translation. The values are: 


0 Disables second stage translation. 


1 Enables second stage translation for execution in EL1 and ELO. 





4.3.35 


To access the HCR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, HCR_EL2; Read EL2 Hypervisor Configuration Register 
MRS HCR_EL2, <Xt>; Write EL2 Hypervisor Configuration Register 


Related information 
4.5.11 Hyp Configuration Register 2 on page 4-259. 
4.5.10 Hyp Configuration Register on page 4-254. 


Architectural Feature Trap Register, EL2 


The CPTR_EL2 characteristics are: 


Purpose 
Controls trapping to EL2 for accesses to the CPACR, Trace functionality and registers 
associated with floating-point and Advanced SIMD execution. Controls EL2 access to this 
functionality. 
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Usage constraints 
The accessibility of the CPTR_EL2 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





RW RW RW 





Configurations 
The CPTR_EL2 is: 


e A 32-bit register in AArch64 state. 
e Architecturally mapped to the AArch32 HCPTR register. 


Attributes 
See the register summary in Table 4-13 AArch64 virtualization registers on page 4-83. 


The following figure shows the CPTR_EL2 bit assignments. 


31 30 21 20 19 14 13 1211 10 9 0 
LTCPAC LTTA reso LTFP 


Figure 4-32 CPTR_EL2 bit assignments 
The following table shows the CPTR_EL2 bit assignments. 


Table 4-48 CPTR_EL2 bit assignments 





Bits Name 


Function 





























[63:32] - Reserved, RESO. 
[31] TCPAC Traps direct access to CPACR from EL1 to EL2. The possible values are: 
0 Access to CPACR is not trapped. This is the reset value. 
1 Access to CPACR is trapped. 
[30:21] - Reserved, RESO. 
[20] TTA This bit is RESO. The processor does not support System register access to trace functionality. 
[19:14] - Reserved, RESO. 
[13:12] - Reserved, RES1. 
[11] - Reserved, RESO. 
[10] TFP Traps instructions that access registers associated with floating-point and SIMD execution from a lower Exception 
level to EL2, unless trapped to EL1. The possible values are: 
0 Instructions are not trapped. This is the reset value. 
1 Instructions are trapped. 
[9:0] - Reserved, RES1. 





To access the CPTR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, CPTR_EL2; Read EL2 Architectural Feature Trap Register 
MSR CPTR_EL2, <Xt>; Write EL2 Architectural Feature Trap Register 


Related information 
4.5.13 Hyp Architectural Feature Trap Register on page 4-263. 
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4.3.36 Hypervisor System Trap Register 


The HSTR_EL2 characteristics are: 


Purpose 
Controls trapping to Hyp mode of Non-secure accesses, at EL1 or lower, of use of Jazelle or the 
CP15 primary coprocessor registers, c0, cl, c2, c3, c5, c6, c7, c8, c9, c10, c11, c12, c13, or c15 
in AArch32 state. 

Usage constraints 
The accessibility to the HSTR_EL2 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- - - RW RW RW 





The accessibility to the HSTR in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations 
The HSTR_EL2 is: 
e A Banked EL? register. 
e Architecturally mapped to AArch32 HSTR register. 


Attributes 
See the register summary in Table 4-13 AArch64 virtualization registers on page 4-83. 


The following figure shows the HSTR_EL2 bit assignments. 


17 16 15 14 13 1211109876543210 





























TTEE al |b TO 
T15 T1 
Reserved T2 
T13 T3 
T12 Reserved 
T11 T5 
T10 T6 
T9 T7 
T8 








Figure 4-33 HSTR_EL2 bit assignments 
The following table shows the HSTR_EL2 bit assignments. 


Table 4-49 HSTR_EL2 bit assignments 





Bits Name Function 





[31:17] - Reserved, RESO. 





[16] TEEE Trap ThumbEE. This value is: 


0 ThumbEE is not supported. 
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Table 4-49 HSTR_EL2 bit assignments (continued) 





Bits Name Function 
[15] T15 Trap coprocessor primary register CRn = 15. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = c15 in AArch32 state to Hyp mode. 





[14] - Reserved, RESO. 





[13] T13 Trap coprocessor primary register CRn = 13. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = c13 in AArch32 state to Hyp mode. 





[12] T12 Trap coprocessor primary register CRn = 12. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = c12 in AArch32 state to Hyp mode. 





[11] T11 Trap coprocessor primary register CRn = 11. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure accesses to coprocessor primary register CRn = cll in AArch32 state to Hyp mode. 





[10] T10 Trap coprocessor primary register CRn = 10. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c10 in AArch32 state to Hyp 
mode. 





[9] T9 Trap coprocessor primary register CRn = 9. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL] accesses to coprocessor primary register CRn = c9 in AArch32 state to Hyp 
mode. 





[8] T8 Trap coprocessor primary register CRn = 8. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c8 in AArch32 state to Hyp 
mode. 





[7] T7 Trap coprocessor primary register CRn = 7. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c7 in AArch32 state to Hyp 
mode. 





[6] T6 Trap coprocessor primary register CRn = 6. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c6 in AArch32 state to Hyp 
mode. 
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Table 4-49 HSTR_EL2 bit assignments (continued) 





Bits Name Function 





[5] T5 Trap coprocessor primary register CRn = 5. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c5 in AArch32 state to Hyp 
mode. 





[4] - Reserved, RESO. 





[3] T3 Trap coprocessor primary register CRn = 3. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c3 in AArch32 state to Hyp 
mode. 





[2] T2 Trap coprocessor primary register CRn = 2. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL] accesses to coprocessor primary register CRn = c2 in AArch32 state to Hyp 
mode. 





[1] T1 Trap coprocessor primary register CRn = 1. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = cl in AArch32 state to Hyp 
mode. 





[0] TO Trap coprocessor primary register CRn = 0. The possible values are: 


0 Has no effect on Non-secure accesses to CP15 coprocessor registers. This is the reset value. 


1 Trap valid Non-secure ELO or EL1 accesses to coprocessor primary register CRn = c0 in AArch32 state to Hyp 
mode. 





To access the HSTR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, HSTR_EL2; Read Hyp System Trap Register 
MSR HSTR_EL2, <Xt>; Write Hyp System Trap Register 


To access the HSTR in AArch32 state, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c1, c1, 3; Read Hyp System Trap Register 
MCR p15, 4, <Rt>, c1, c1, 3; Write Hyp System Trap Register 


4.3.37 Hyp Auxiliary Configuration Register 


The processor does not implement HACR_EL2 in AArch64 state. This register is Reso in EL2 and EL3. 


The processor does not implement HACR in AArch32 state. This register is REso in Hyp mode and in 
Monitor mode when SCR.NS is 1. 


4.3.38 System Control Register, EL3 


The SCTLR_EL3 characteristics are: 


Purpose 
Provides top-level control of the system, including its memory system at EL3 in AArch6é4 state. 
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Usage constraints 
The accessibility of the SCTLR_EL3 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - - RW RW 





Configurations 
The SCTLR_EL3 is: 


e A 32-bit register in AArch64 state. 
e Architecturally mapped to Secure AArch32 SCTLR register. 


Attributes 
See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 


The following figure shows the SCTLR_EL3 bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 201918171615 131211 10 6543210 





Figure 4-34 SCTLR_EL3 bit assignments 
The following table shows the SCTLR_EL3 bit assignments. 


Table 4-50 SCTLR_EL3 bit assignments 


Function 





















































[63:30] - Reserved, RESO. 
[29:28] - Reserved, RES1. 
[27:26] - Reserved, RESO. 
[25] EE Exception endianness. The values are: 
0 Little-endian. 
1 Big-endian. 
The reset value depends on the primary input CFGEND. 
[24] - Reserved, RESO. 
[23:22] - Reserved, RES1. 
[21:20] - Reserved, RESO. 
[19] WXN Force treatment of all memory regions with write permissions as XN. The values are: 
0 Regions with write permissions are not forced to XN. This is the reset value. 
1 Regions with write permissions are forced to XN. 
[18] - Reserved, RES1. 
[17] - Reserved, RESO. 
[16] - Reserved, RES1. 
[15:13] - Reserved, RESO. 
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Table 4-50 SCTLR_EL3 bit assignments (continued) 





Bits Name Function 
































[12] I Global instruction cache enable. The values are: 
0 Instruction caches disabled. 
1 Instruction caches enabled. 
[11] - Reserved, RES1. 
[10:6] - Reserved, RESO. 
[5:4] - Reserved, RES1. 
[3] SA Enables Stack Alignment check. The values are: 
0 Disables Stack Alignment check. This is the reset value 
1 Enables Stack Alignment check. 
[2] C Global enable for data and unified caches. The values are: 
0 Disables data and unified caches. This is the reset value. 
1 Enables data and unified caches. 
[1] A Enable Alignment fault check. The values are: 
0 Disables Alignment fault checking. This is the reset value. 
1 Enables Alignment fault checking. 
[0] M Global enable for the EL1 and ELO stage 1 MMU. The values are: 
0 Disables EL1 and ELO stage 1 MMU. This is the reset value. 
1 Enables EL1 and ELO stage 1 MMU. 
To access the SCTLR_EL3 in AArch64 state, read or write the register with: 
MRS <Xt>, SCTLR_EL3; Read EL3 System Control Register 
MSR SCTLR_EL3, <Xt>; Write EL3 System Control Register 
Related information 
4.5.5 System Control Register on page 4-242. 
4.3.39 Auxiliary Control Register, EL3 
The ACTLR_EL3 characteristics are: 
Purpose 
Enables access to the control registers for the L2 cache and the processor control registers. 
ACTLR_EL3 is used in conjunction with the ACTLR_EL2 register. 
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Usage constraints 
The accessibility to the ACTLR_EL3 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - - RW RW 





The accessibility to the ACTLR in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Configurations 
The ACTLR_EL3 is: 
e A Banked register. 
e Mapped to the Secure AArch32 ACTLR register. 


Attributes 
See the register summary in Table 4-4 AArch64 other System registers on page 4-79. 


The following figure shows the ACTLR_EL3 bit assignments. 


31 765432 rT 
onr —] | 
‘acorn — | 
L2CTLR 
CPUECTLR 
CPUACTLR 


Figure 4-35 ACTLR_EL3 bit assignments 
The following table shows the ACTLR_EL3 bit assignments. 


Table 4-51 ACTLR_EL3 bit assignments 





Bits Name Function 





[31:7] - Reserved, RESO. 





[6] L2ACTLR L2 Auxiliary Control Register. The possible values are: 


0 The register is not accessible from a lower Exception level. This is the reset value. 


1 The register is accessible from a lower Exception level. 





[5] L2ECTLR L2 Extended Control Register. The possible values are: 


0 The register is not accessible from a lower Exception level. This is the reset value. 


1 The register is accessible from a lower Exception level. 





[4] L2CTLR L2 Control Register. The possible values are: 
0 The register is not accessible from a lower Exception level. This is the reset value. 


1 The register is accessible from a lower Exception level. 





[3:2] - Reserved, RESO. 
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Table 4-51 ACTLR_EL3 bit assignments (continued) 





Bits Name Function 





[1] CPUECTLR CPU Extended Control Register. The possible values are: 


0 The register is not accessible from a lower Exception level. This is the reset value. 


1 The register is accessible from a lower Exception level. 





[0] CPUACTLR CPU Auxiliary Control Register. The possible values are: 
0 The register is not accessible from a lower Exception level. This is the reset value. 


1 The register is accessible from a lower Exception level. 





To access the ACTLR_EL3 in AArch64 state, read or write the register with: 


MRS <Xt>, ACTLR_EL3; Read Auxiliary Control Register 
MSR ACTLR_EL3, <Xt>; Write Auxiliary Control Register 


To access the ACTLR in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c1, c@, 1; Read Auxiliary Control Register 
MCR p15, ©, <Rt>, c1, c@, 1; Write Auxiliary Control Register 


Related information 
4.3.33 Auxiliary Control Register, EL2 on page 4-130. 


4.3.40 Architectural Feature Trap Register, EL3 


The CPTR_EL3 characteristics are: 


Purpose 
Controls trapping to EL3 for accesses to the CPACR_ELI register, trace functionality and 
registers associated with floating-point and SIMD execution. Also controls EL3 access to this 
functionality. 

Usage constraints 
The accessibility of the CPTR_EL3 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW 





Configurations 
The CPTR_EL3 is a 32-bit register. 
Attributes 
See the register summary in Table 4-12 AArch64 security registers on page 4-83. 


The following figure shows the CPTR_EL3 bit assignments. 


31 30 21 20.19 1110 9 0 
LTCPAC LTTA LTFP 


Figure 4-36 CPTR_EL3 bit assignments 
The following table shows the CPTR_EL3 bit assignments. 
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Table 4-52 CPTR_EL3 bit assignments 





Bits Name 


Function 























[63:32] - Reserved, RESO. 

[31] TCPAC Traps direct access to CPACR_EL1 from EL1 to EL3. The possible values are: 
0 Access to CPACR_ EL] is not trapped. This is the reset value. 
1 Access to CPACR_EL1 is trapped. 

[30:21] - Reserved, RESO. 

[20] TTA This bit is RESO. The processor does not support System register access to trace functionality. 

[19:11] - Reserved, RESO. 

[10] TFP Traps instructions that access registers associated with floating-point and Advanced SIMD execution from a lower 
Exception level to EL3, unless trapped to EL1. The possible values are: 
0 Instructions that access registers associated with floating-point and Advanced SIMD execution are not trapped. 
1 Instructions that access registers associated with floating-point and Advanced SIMD execution are trapped. This 

is the reset value. 
[9:0] - Reserved, RESO. 





To access the CPTR_EL3 in AArch64 state, read or write the register with: 


MRS <Xt>, CPTR_EL3; Read EL3 Architectural Feature Trap Register 
MSR CPTR_EL3, <Xt>; Write EL3 Architectural Feature Trap Register 


4.3.41 Translation Control Register, EL1 


63 
RESO 





The TCR_ELI characteristics are: 


Purpose 
Controls which Translation Base Register defines the base address register for a translation table 
walk required for stage 1 translation of a memory access from ELO or EL1. Also controls the 
translation table format and holds cacheability and shareability information. 

Usage constraints 
The accessibility of the TCR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Configurations 

TCR_EL1[31:0] is architecturally mapped to the Non-secure AArch32 TTBCR register. 
Attributes 

See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 


The following figure shows the TCR_EL1 bit assignments. 


39 38 37 36 35 34 32 31 30 29 28 27 26 25 24 23 22 21 161514131211109 8 7 6 5 





| eee Loe L—EPD1 L—TGO L— RESO 
a Raa IRGN1 RESO EPDO 
TBI1 ORGN1 IRGNO 


ORGNO 


Figure 4-37 TCR_EL1 bit assignments 
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The following table shows the TCR_EL1 bit assignments. 


Table 4-53 TCR_EL1 bit assignments 





Bits Name 


Function 





























[63:39] - Reserved, RESO. 
[38] TBI] Top Byte Ignored. Indicates whether the top byte of the input address is used for address match for the TTBR1 
region. The values are: 
0 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[37] TBIO Top Byte Ignored. Indicates whether the top byte of the input address is used for address match for the TTBRO 
region. The values are: 
0 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[36] AS ASID size. The values are: 
0 8-bit. 
1 16-bit. 
[35] - Reserved, RESO. 
[34:32] IPS Intermediate Physical Address Size. The possible values are: 
ebeee 32-bit, 4GBytes. 
@bee1 36-bit, 64GBytes. 
0b010 40-bit, 1TByte. 
b011 42-bit, 4TBytes. 
b100 44-bit, 16TBytes. 
@b101 48-bit, 256TBytes. 
[31] - Reserved, RES1. 
[30] TG1 TTBR1_ ELI granule size. The values are: 
0 4KB. 
1 64KB. 
[29:28] SH1 Shareability attribute for memory associated with translation table walks using TTBR1. The values are: 


@bee Non-shareable. 
@be1 Reserved. 

@b10 Outer Shareable. 
@b11 Inner Shareable. 





[27:26] ORGNI 


Outer cacheability attribute for memory associated with translation table walks using TTBR1. The values are: 








@bee Normal memory, Outer Non-cacheable. 
@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 
@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 
ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. 4-147 


Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


Table 4-53 TCR_EL1 bit assignments (continued) 





Bits Name 


Function 





[25:24] IRGNI 


Inner cacheability attribute for memory associated with translation table walks using TTBR1. The values are: 








@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-A locate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
[23] EPD1 Translation table walk disable for translations using TTBR1. Controls if a translation table walk is performed on a 
TLB miss for an address that is translated using TTBR1. The values are: 
0 Perform translation table walk using TTBR1. 
1 A TLB miss on an address translated from TTBR1 generates a Translation fault. No translation 
table walk is performed. 
[22] Al Selects whether TTBRO or TTBR1 defines the ASID. The values are: 


0 TTBRO.ASID defines the ASID. 
1 TTBR1.ASID defines the ASID. 





Size offset of the memory region addressed by TTBR1. The region size is 24 TS!2®) bytes. 





Reserved, RESO. 








[14] TGO TTBRO_EL1 granule size. The values are: 
0 4KB. 
1 64KB. 
[13:12] SHO Shareability attribute for memory associated with translation table walks using TTBRO. The values are: 


@be0e Non-shareable. 
@be1 Reserved. 

@b10 Outer Shareable. 
@b11 Inner Shareable. 





[11:10] ORGNO 


Outer cacheability attribute for memory associated with translation table walks using TTBRO. The values are: 

















Q@bee Normal memory, Outer Non-cacheable. 
@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 
@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 

[9:8] IRGNO Inner cacheability attribute for memory associated with translation table walks using TTBRO. The values are: 
@bee Normal memory, Inner Non-cacheable. 
@be1 Normal memory, Inner Write-Back Write-A locate Cacheable. 
@b10 Normal memory, Inner Write-Through Cacheable. 
@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 

[7:6] - Reserved, RESO. 

[5:0] TOSZ Size offset of the memory region addressed by TTBRO. The region size is 24TS!ZE) bytes. 
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To access the TCR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, TCR_EL1; Read EL1 Translation Control Register 
MSR TCR_EL1, <Xt>; Write EL1 Translation Control Register 


Related information 
4.5.15 Translation Table Base Control Register on page 4-265. 


4.3.42 Translation Control Register, EL2 
The TCR_EL2 characteristics are: 


Purpose 
Controls translation table walks required for stage 1 translation of a memory access from EL2 
and holds cacheability and shareability information. 

Usage constraints 
The accessibility of the TCR_EL2 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW RW 
Configurations 
The TCR_EL2 is architecturally mapped to the AArch32 HCTR register. 
Attributes 


See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 


The following figure shows the TCR_EL2 bit assignments. 


31 30 24 23 2221201918 161514131211109 8 7 6 5 0 





Figure 4-38 TCR_EL2 bit assignments 
The following table shows the TCR_EL2 bit assignments. 


Table 4-54 TCR_EL2 bit assignments 





Bits Name Function 




















[31] - Reserved, RES1. 
[30:24] - Reserved, RESO. 
[23] - Reserved, RES1. 
[22:21] - Reserved, RESO. 
[20] TBI Top Byte Ignored. Indicates whether the top byte of the input address is used for address match. The values are: 











0 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[19] - Reserved, RESO. 
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Table 4-54 TCR_EL2 bit assignments (continued) 





Bits Name Function 





[18:16] PS Physical Address size. The possible values are: 
ebeee 32-bit, 4GBytes. 
@be01 36-bit, 64GBytes. 
0b010 40-bit, 1TByte. 
@be11 42-bit, 4TBytes. 
@b100 44-bit, 16TBytes. 
@b101 48-bit, 256TBytes. 


All other values are reserved. 





[15] - Reserved, RESO. 





[14] TGO TTBRO_EL2 granule size. The values are: 


0 4KByte. 
1 64KByte. 





[13:12] SHO Shareability attribute for memory associated with translation table walks using TTBRO. The values are: 


@bee Non-shareable. 
@be1 Reserved. 

@b10 Outer Shareable. 
@b11 Inner Shareable. 





[11:10] ORGNO Outer cacheability attribute for memory associated with translation table walks using TTBRO. The values are: 


Ob Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] IRGNO Inner cacheability attribute for memory associated with translation table walks using TTBRO. The values are: 





e@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-A locate Cacheable. 

@b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
[7:6] - Reserved, RESO. 





[5:0] TOSZ Size offset of the memory region addressed by TTBRO. The region size is 2(6^TSIZE) bytes. 





To access the TCR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, TCR_EL2; Read EL2 Translation Control Register 
MSR TCR_EL2, <Xt>; Write EL2 Translation Control Register 


Related information 
4.5.16 Hyp Translation Control Register on page 4-266. 
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4.3.43 Virtualization Translation Control Register, EL2 
The VTCR_EL2 characteristics are: 
Purpose 
Controls the translation table walks required for the stage 2 translation of memory accesses from 
Non-secure ELO and EL1, and holds cacheability and shareability information for the accesses. 
Usage constraints 
The accessibility to the VTCR_EL2 by Exception level is: 
ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 
- - - RW RW RW 
Configurations 
The VTCR_EL2 is: 
e A32-bit register in AArch64 state. 
e Architecturally mapped to the AArch32 VTCR register. 
Attributes 
See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 
The following figure shows the VTCR_EL2 bit assignments. 
31 30 19 18 161514131211109 8 7 6 5 
LRes1 _TGO L|RGNO 
RESO ORGNO 
Figure 4-39 VTCR_EL2 bit assignments 
The following table shows the VTCR_EL2 bit assignments. 
Table 4-55 VTCR_EL2 bit assignments 
Bits Name Function 
[31] - Reserved, RES1. 
[30:19] - Reserved, RESO. 
[18:16] PS Physical Address Size. The possible values are: 
@beee 32-bit, 4GBytes. 
@bee01 36-bit, 64GBytes. 
@be1e 40-bit, 1TByte. 
@be11 42-bit, 4TBytes. 
0b100 44-bit, 16TBytes. 
@b101 48-bit, 256TBytes. 
All other values are reserved. 
[15] - Reserved, RESO. 
[14] TGO Granule size for the corresponding TTBRO_ELx. 
0 4KB. 
1 64KB. 
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Table 4-55 VTCR_EL2 bit assignments (continued) 





Bits Name Function 





[13:12] SHO Shareability attribute for memory associated with translation table walks using TTBRO: 


@bee Non-shareable. 
@be1 Reserved. 

@b11 Outer Shareable. 
@b11 Inner Shareable. 





[11:10] ORGNO Outer cacheability attribute for memory associated with translation table walks using TTBRO. 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b11 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] IRGNO Inner cacheability attribute for memory associated with translation table walks using TTBRO. 


@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-A llocate Cacheable. 
@b11 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 





[7:6] SLO Starting level of the VTCR_EL2 addressed region. 





[5:0] TOSZ The size offset of the memory region addressed by TTBRO. The region size is 2+-T9S4) bytes. 





To access the VTCR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, VTCR_EL2; Read EL2 Virtualization Translation Control Register 
MSR VTCR_EL2, <Xt>; Write EL2 Virtualization Translation Control Register 


4.3.44 Translation Table Base Register 0, EL1 


The TTBRO_ ELI characteristics are: 


Purpose 
Holds the base address of translation table 0, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses at EL1 if the 
highest Exception level is in AArch64 state. 

Usage constraints 
The TTBRO_ ELI is used in conjunction with TCR_EL1. 


The accessibility to the TTBRO_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 








- RW RW RW RW RW 
Configurations 
TTBRO_ EL} is architecturally mapped to the Non-secure AArch32 register TTBRO. 
Attributes 


See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 


The following figure shows the TTBRO_ EL] bit assignments. 
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48 47 


10 9 0 
ASID BADDR | Reserved 


Figure 4-40 TTBRO_EL1 bit assignments 
The following table shows the TTBRO_EL1 bit assignments. 


Table 4-56 TTBRO_EL1 bit assignments 





Bits Name Function 





[63:48] ASID An ASID for the translation table base address. 
The TCR_EL1.A1 field selects either the TTBRO.ASID or the TTBR1.ASID. 
The TCR_EL1.AS bit selects whether all 16-bits [63:48] or the lower 8-bits [55:48] indicate the current ASID. 





[47:10] BADDR Translation table base address. Defining the translation table base address width. 





[9:0] - Reserved, RESO. 





To access the TTBRO_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, TTBR@_EL1; Read EL1 Translation Table Base Register @ 
MSR TTBR@_EL1, <Xt>; Write EL1 Translation Table Base Register @ 


4.3.45 Translation Table Base Register 0, EL3 


The TTBRO_EL3 characteristics are: 


Purpose 
Holds the base address of the translation table for the stage 1 translation of memory accesses 
from EL3. 

Usage constraints 
The accessibility to the TTBRO_EL3 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 








= z - - RW RW 
Configurations 
TTBRO_EL3 is mapped to the Secure AArch32 TTBRO register. 
Attributes 


See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 
The following figure shows the TTBRO_EL3 bit assignments. 


48 47 


63 10 9 0 
Reserved BADDR Reserved 


Figure 4-41 TTBRO_EL3 bit assignments 


The following table shows the TTBRO_EL3 bit assignments. 
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Table 4-57 TTBRO_EL3 bit assignments 





Bits Name Function 





[63:48] - Reserved, RESO. 





[47:10] BADDR Translation table base address. Defining the translation table base address width. 





[9:0] - Reserved, UNK/RESO. 





To access the TTBRO_EL3 in AArch64 state, read or write the register with: 


MRS <Xt>, TTBR@_EL3; Read EL3 Translation Table Base Register @ 
MSR TTBR@_EL3, <Xt>; Write EL3 Translation Table Base Register @ 














4.3.46 Translation Table Base Register 1, EL1 
The TTBR1_ ELI characteristics are: 
Purpose 
Holds the base address of translation table 1, and information about the memory it occupies. 
This is one of the translation tables for the stage 1 translation of memory accesses at ELO and 
ELI. This is one of the translation tables for the stage 1 translation of memory accesses at EL1 
if the highest Exception level is in AArch64 state. 
Usage constraints 
The TTBR1_ ELI is used in conjunction with TCR_EL1. 
The accessibility to the TTBR1_EL1 by Exception level is: 
ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 
- RW RW RW RW RW 
Configurations 
TTBRI1_ EL] is architecturally mapped to the Non-secure AArch32 register TTBR1. 
Attributes 
See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 
The following figure shows the TTBR1_EL1 bit assignments. 
63 48 47 10 9 0 
ASID BADDR Reserved 
Figure 4-42 TTBR1_EL1 bit assignments 
The following table shows the TTBRO_EL1 bit assignments. 
Table 4-58 TTBR1_EL1 bit assignments 
Bits Name Function 





[63:48] ASID An ASID for the translation table base address. 


The TCR_EL1.A1 field selects either the TTBRO.ASID or the TTBR1.ASID. 
The TCR_EL1.AS bit selects whether all 16-bits [63:48] or the lower 8-bits [55:48] indicate the current ASID. 





[47:10] BADDR Translation table base address. Defining the translation table base address width. 





[9:0] 


Reserved, RESO. 
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To access the TTBRO_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, TTBR1_EL1; Read EL1 Translation Table Base Register 1 
MSR TTBR1_EL1, <Xt>; Write EL1 Translation Table Base Register 1 


4.3.47 Translation Control Register, EL3 
The TCR_EL3 characteristics are: 


Purpose 
Controls translation table walks required for stage | translation of memory accesses from EL3 
and holds cacheability and shareability information for the accesses. 

Usage constraints 
The accessibility of the TCR_EL3 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





i s - - RW RW 
Configurations 
The TCR_EL3 is architecturally mapped to the Secure AArch32 TTBCR register. 
Attributes 


See the register summary in Table 4-3 AArch64 virtual memory control registers on page 4-78. 
The following figure shows the TCR_EL3 bit assignments. 


31 30 24 23 22 21 20 1918 161514131211109 8 7 6 5 





LRes1 LRes1 L- RESO L- TGO LIRGNO 
TBI RESO ORGNO 


Figure 4-43 TCR_EL3 bit assignments 


The following table shows the TCR_EL3 bit assignments. 


Table 4-59 TCR_EL3 bit assignments 





Bits Name Function 




















[31] - Reserved, RES1. 
[30:24] - Reserved, RESO. 
[23] - Reserved, RES1. 
[22:21] - Reserved, RESO. 
[20] TBI Top Byte Ignored. Indicates whether the top byte of the input address is used for address match. The values are: 











0 Top byte used in the address calculation. 
1 Top byte ignored in the address calculation. 
[19] - Reserved, RESO. 
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Table 4-59 TCR_EL3 bit assignments (continued) 





Bits Name Function 








[18:16] PS Physical Address size. The possible values are: 
ebeee 32 bits, 4GBytes. 
@bee1 36 bits, 64GBytes. 
0b010 40 bits, 1TByte. 
@be11 42 bits, 4TBytes. 
@b100 44 bits, 16TBytes. 
@b101 48 bits, 256TBytes. 
[15] - Reserved, RESO. 





[14] TGO TTBRO_EL3 granule size. The values are: 


0 4KByte. 
1 64KByte. 





[13:12] SHO Shareability attribute for memory associated with translation table walks using TTBRO. The values are: 


@bee Non-shareable. 
@be1 Reserved. 

@b10 Outer Shareable. 
@b11 Inner Shareable. 





[11:10] ORGNO Outer cacheability attribute for memory associated with translation table walks using TTBRO. The values are: 


@bee Normal memory, Outer Non-cacheable. 

@be1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
@b10 Normal memory, Outer Write-Through Cacheable. 

@b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 





[9:8] IRGNO Inner cacheability attribute for memory associated with translation table walks using TTBRO. The values are: 





e@bee Normal memory, Inner Non-cacheable. 

@be1 Normal memory, Inner Write-Back Write-A llocate Cacheable. 

@b10 Normal memory, Inner Write-Through Cacheable. 

@b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
[7:6] - Reserved, RESO. 





[5:0] TOSZ Size offset of the memory region addressed by TTBRO. The region size is 2(6^TSIZE) bytes. 





To access the TCR_EL3 in AArch64 state, read or write the register with: 


MRS <Xt>, TCR_EL3; Read EL3 Translation Control Register 
MRS TCR_EL3, <Xt>; Read EL3 Translation Control Register 


Related information 
4.5.15 Translation Table Base Control Register on page 4-265. 


4.3.48 Auxiliary Fault Status Register 0, EL1 and EL3 


The processor implements AFSRO_EL1, AFSRO_EL3, and ADFSR as REso. 
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4.3.49 Auxiliary Fault Status Register 1, EL1 and EL3 


The processor implements AFSR1_EL1, AFSR1_EL3, and AIFSR as reso. 


4.3.50 Exception Syndrome Register, EL1 and EL3 
The ESR_EL1 and ESR_EL3 characteristics are: 


Purpose 
ESR_ELI holds syndrome information for an exception taken to EL1. 


ESR_EL3 holds syndrome information for an exception taken to EL3. 


Usage constraints 
The accessibility to the ESR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





The accessibility to the ESR_EL3 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW 





Configurations 
The ESR_EL1 is architecturally mapped to the Non-secure AArch32 DFSR register. 


The ESR_EL3 is mapped to the Secure AArch32 DFSR register. 


Attributes 
See the register summary in Table 4-2 AArch64 exception handling registers on page 4-78. 


EC==0b100000 and EC==0b100001, Instruction Aborts 


This section describes the IMPLEMENTATION DEFINED behavior of the EA bit for Instruction Abort 
exceptions. 


The following figure shows the ESR_EL1 and ESR_EL3 bit assignments for the Instruction Abort 
exception classes, that is, when EC==0b100000 or EC==0b100001. 


31 26 25 24 109 8765 0 


L IL L Reserved 
S1TPW 
Reserved 


EA 


Figure 4-44 ESR_EL1 and ESR_EL3 bit assignments 


The following table shows the ESR_EL1 and ESR_EL3 bit assignments for the Instruction Abort 
exception class. 
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Table 4-60 ESR_EL1 and ESR_EL3 bit assignments 





Bits Name 


Function 
































[31:26] EC Exception Class: 
0b100000 Instruction Abort that caused entry from a lower Exception level in AArch32 or AArch64. 
0b100001 Instruction Abort that caused entry from a current Exception level in AArch64. 
[25] IL Instruction Length for synchronous exceptions. 
[24:10] - Reserved, RESO. 
[9] EA External abort type. This bit indicates whether an AXI decode or slave error caused an abort. The possible values 
are: 
0 External abort marked as DECERR. 
1 External abort marked as SLVERR. 
For aborts other than external aborts this bit always returns 0. 
[8] - Reserved, RESO. 
[7] SIPTW When 1, indicates the instruction fault came from a second stage fault during a first stage translation table walk. 
[6] - Reserved, RESO. 
[5:0] IFSC Instruction Fault Status Code. This field indicates the type of exception generated. The possible values are: 
Ob000000 Address size fault in TTBRO or TTBR1. 
0b000101 Translation fault, 1st level. 
00b00110 Translation fault, 2nd level. 
00b00111 Translation fault, 3rd level. 
0b001001 Access flag fault, 1st level. 
0b0019010 Access flag fault, 2nd level. 
0b001011 Access flag fault, 3rd level. 
0b001101 Permission fault, 1st level. 
0b001110 Permission fault, 2nd level. 
0b001111 Permission fault, 3rd level. 
0b010000 Synchronous external abort. 
0b011000 Synchronous parity error on memory access. 
0b010101 Synchronous external abort on translation table walk, 1st level. 
0b010110 Synchronous external abort on translation table walk, 2nd level. 
0b010111 Synchronous external abort on translation table walk, 3rd level. 
0b011101 Synchronous parity error on memory access on translation table walk, 1st level. 
@be@11110 Synchronous parity error on memory access on translation table walk, 2nd level. 
@b011111 Synchronous parity error on memory access on translation table walk, 3rd level. 
0b100001 Alignment fault. 
0b100010 Debug event. 
All other values are reserved. 
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The lookup level associated with a fault is: 

e Fora fault generated on a translation table walk, the lookup level of the walk being performed. 

¢ Fora Translation fault, the lookup level of the translation table that gave the fault. If a fault occurs 
because an MMU is disabled, or because the input address is outside the range specified by the 
appropriate base address register or registers, the fault is reported as a First level fault. 

e Foran Access flag fault, the lookup level of the translation table that gave the fault. 

e Fora Permission fault, including a Permission fault cased by hierarchical permissions, the lookup 
level of the final level of translation table accessed for the translation. That is, the lookup level of the 
translation table that returned a Block or Page descriptor. 


All exception classes except the Instruction Abort are architecturally defined in the ARM® Architecture 
Reference Manual ARMVv8. The SError Interrupt exception classes are architecturally defined in the 
ARM® Generic Interrupt Controller Architecture Specification, GICv3 with the exception of four bits. 


The following changes are Cortex-A72 implementation-defined and only apply to SError Interrupt 
exception classes. 


Table 4-61 ESR_EL1 and ESR_EL3 Cortex-A72 implementation-defined SError Interrupt exception classes bit assignments 














Bits Name Function 
[15] Unattributable System Error gb1 Unattributable - cannot be attributed to the processing element counting the 
event. 
@be Attributable - can be attributed to the processing element counting the event. 
[14] Uncontainable System Error @b1 Uncontainable — an event which cannot be contained to a particular code 
sequence. 
Qbe Containable - an Attributable event which can be contained to a particular code 
sequence. 
[1:0] System Error Source e@bee Decode error 
Qbe1 ECC error 
0b10 Slave error 
@b11 Reserved 





4.3.51 Instruction Fault Status Register, EL2 


The IFSR32_EL2 characteristics are: 


Purpose 
Holds status information about the last instruction fault. 
Usage constraints 
The accessibility to the IFSR32_EL2 in AArch64 state by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW RW 





The accessibility to the IFSR in AArch32 state by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 
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Configurations 
The IFSR32_EL2 is: 
e Banked for Secure and Non-secure states. 
e Mapped to the Non-secure AArch32 IFSR register. 


Attributes 
See the register summary in Table 4-2 AArch64 exception handling registers on page 4-78. 


There are two formats for this register. The value of TTBCR.EAE selects which format of the register is 
used. The two formats are: 

e IFSR32_EL2 format when using the Short-descriptor translation table format. 

e IFSR32_EL2 format when using the Long-descriptor translation table format. 


IFSR32_EL2 format when using the Short-descriptor translation table format 


The following figure shows the IFSR32_EL2 bit assignments when using the Short-descriptor translation 
table format. 


31 13121110 9 8 4 


3 0 
~ e Meie 
Para LLPAE 
RESO FS[4] 
Figure 4-45 IFSR32_EL2 bit assignments for Short-descriptor translation table format 


The following table shows the IFSR32_EL2 bit assignments when using the Short-descriptor translation 
table format. 


Table 4-62 IFSR32_EL2 bit assignments for Short-descriptor translation table format 





Bits Name Function 


[31:13] - Reserved, RESO. 





[12] ExT External abort type. This field indicates whether an AXI decode or slave error caused an abort. The possible values 
are: 


0 External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11] - Reserved, RESO. 





[10] FS[4] MSB of the Fault Status field. See bits[3:0] in this table. 











[9] LPAE Large physical address extension. The value of the format descriptor is: 
0 Short-descriptor translation table formats. 
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Table 4-62 IFSR32_EL2 bit assignments for Short-descriptor translation table format (continued) 





Bits Name Function 





[8:4] - Reserved, RESO. 





[3:0] | FS[3:0] Fault Status bits. This field indicates the type of exception generated. The possible values are: 


0b00001 Alignment fault. 

0b01100 Synchronous external abort on translation table walk, 1st level. 
0b01110 Synchronous external abort on translation table walk, 2nd level. 
0b11100 Synchronous parity error on translation table walk, 1st level. 
@b11110 Synchronous parity error on translation table walk, 2nd level. 
0bee101 Translation fault, 1st level. 

0b00111 Translation fault, 2nd level. 

0b00011 Access flag fault, 1st level. 

0b00110 Access flag fault, 2nd level. 

0b01001 Domain fault, 1st level. 

0b01011 Domain fault, 2nd level. 

0b01101 Permission fault, 1st level. 

0b01111 Permission fault, 2nd level. 

0b00010 Debug event. 

0b01000 Synchronous external abort, non-translation. 

0b11001 Synchronous parity error on memory access. 


All other values are reserved. 





IFSR32_EL2 format when using the Long-descriptor translation table format 


The following figure shows the IFSR32_EL2 bit assignments when using the Long-descriptor translation 
table format. 


31 131211109 8 65 0 
mm | fase] J men s | 
ExT- LLPAE 


Figure 4-46 IFSR32_EL2 bit assignments for Long-descriptor translation table format 


The following table shows the IFSR32_EL2 bit assignments when using the Long-descriptor translation 
table format. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 4-161 
Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


Table 4-63 IFSR32_EL2 bit assignments for Long-descriptor translation table format 





Bits Name Function 








[31:13] - Reserved, res0. 
[12] ExT External abort type. This field indicates whether an AXI decode or slave error caused an abort. The possible values 
are: 


0 External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 











[11:10] - Reserved, res0. 

[9] LPAE Large physical address extension. The value of the format descriptor is: 
1 Long-descriptor translation table formats. 

[8:6] - Reserved, res0. 





[5:0] Status Fault Status bits. This field indicates the type of exception generated. The possible values are: 


@bee@@LL Address size fault, LL bits indicate level. 

@bee01LL Translation fault, LL bits indicate level. 

@be@@1@LL Access flag fault, LL bits indicate level. 

@b@011LL Permission fault, LL bits indicate level. 

0b010009 Synchronous external abort. 

@b@110@@ Synchronous parity error on memory access. 

@b@1@1LL Synchronous external abort on translation table walk, LL bits indicate level. 

@b@111LL Synchronous parity error on memory access on translation table walk, LL bits indicate level. 
@b19e001 Alignment fault. 

@b100010 Debug event. 


All other values are reserved. 





The following table shows how the LL bits in the Status field encode the lookup level associated with the 
MMU fault. 


Table 4-64 Encodings of LL bits associated with the MMU fault 





LL bits Meaning 














00 Level 0 

01 First level 
10 Second level 
11 Third level 








Note 


If a Data Abort exception is generated by an Instruction Cache maintenance operation, the fault is 
reported as a Cache Maintenance fault in the DFSR or HSR with the appropriate Fault Status code. For 
such exceptions reported in the DFSR, the corresponding IFSR is UNKNOWN. 
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To access the IFSR32_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, IFSR32_EL2; Read EL2 Instruction Fault Status Register 
MSR IFSR32_EL2, <Xt>; Write EL2 Instruction Fault Status Register 


To access the IFSR in AArch32 state, read or write the CP15 register with: 


MRC p15, @, <Rt>, c5, c@, 1; Read Instruction Fault Status Register 
MCR p15, ©, <Rt>, c5, c0, 1; Write Instruction Fault Status Register 


Related information 
IFSR32_EL2 format when using the Short-descriptor translation table format on page 4-160. 
IFSR32_EL2 format when using the Long-descriptor translation table format on page 4-161. 


4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp Auxiliary Data Fault Status Register 
The processor implements AFSRO_EL2 and HADFSR as RESO. 


4.3.53 Auxiliary Fault Status Register 1, EL2 and Hyp Auxiliary Instruction Fault Status Register 
The processor implements AFSR1 EL2 and HAIFSR as RES0. 


4.3.54 Exception Syndrome Register, EL2 


The ESR_EL2 characteristics are: 





Purpose Holds syndrome information for an exception taken to EL2. 
Usage The accessibility to the ESR_EL2 in AArch64 state by Exception level is: 
constraints 


ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW RW 





The accessibility to the HSR in AArch32 state by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations The ESR _EL2 is: 
¢ A Banked EL? register. 
e Architecturally mapped to the AArch32 HSR register. 


Attributes See the register summary in Table 4-2 AArch64 exception handling registers 
on page 4-78. 


The following figure shows the ESR_EL2 bit assignments. 


31 26 25 24 0 


Figure 4-47 ESR_EL2 bit assignments 
The following table shows the ESR_EL2 bit assignments. 
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Table 4-65 ESR_EL2 bit assignments 





Bits Name Function 





[31:26] EC Exception class. The exception class for the exception that is taken in Hyp mode. 


When zero, this field indicates that the reason for the exception is not known. In this case, the other fields in this 
register are UNKNOWN. Otherwise, the field holds the exception class for the exception. See the ARM® Architecture 
Reference Manual ARMV8 for more information. 





[25] IL Instruction length. Indicates the size of the instruction that has been trapped to Hyp mode. The values are: 
0 16-bit instruction. 
1 32-bit instruction. 


This field is not valid for: 


¢ Instruction Aborts. 
e Data Aborts that do not have ISS information, or for which the ISS is not valid. 


In these cases the field is RESO. 





[24:0] ISS Instruction specific syndrome. The interpretation of this field depends on the value of the EC field. See Encoding of 
ISS[24:20] when HSR[31:30] is 0b00 on page 4-164>. 





All exception classes except the Instruction Abort are architecturally defined in the ARM® Architecture 
Reference Manual ARMVv8. The SError Interrupt exception classes are architecturally defined in the 
ARM® Generic Interrupt Controller Architecture Specification, GICv3 with the exception of four bits. 


The following changes are Cortex-A72 implementation-defined and only apply to SError Interrupt 
exception classes. 


Table 4-66 ESR_EL2 Cortex-A72 implementation-defined SError Interrupt exception classes bit assignments 





Bits Name Function 





[15] Unattributable System Error @b1 Unattributable - cannot be attributed to the processing element counting the event. 


bð Attributable - can be attributed to the processing element counting the event. 





[14] Uncontainable System Error @b1 Uncontainable — an event which cannot be contained to a particular code sequence. 


@b@ Containable - an Attributable event which can be contained to a particular code sequence. 





[1:0] System Error Source e@bee Decode error 
@be1 ECC error 
0b10 Slave error 
@b11 Reserved 





Encoding of ISS[24:20] when HSR[31:30] is 0b00 


For EC values that are nonzero and have the two most-significant bits @b@0, ISS[24:20] provides the 
condition field for the trapped instruction, together with a valid flag for this field. The encoding of this 
part of the ISS field is: 

CV, ISS[24] Condition valid. Possible values of this bit are: 


0 The COND field is not valid. 
1 The COND field is valid. 
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When an instruction is trapped, CV is set to 1. 


COND, The Condition field for the trapped instruction. This field is valid only when CV is set to 
ISS[23:20] 1. 


If CV is set to 0, this field is UNK/REso. 
When an instruction is trapped, the COND field is @xE. 
To access the ESR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, ESR_EL2; Read EL2 Exception Syndrome Register 
MSR ESR_EL2, <Xt>; Write EL2 Exception Syndrome Register 


To access the HSR in AArch32 state, read or write the CP15 register with: 
MRC p15, 4, <Rt>, c5, c1, @; Read Hyp Syndrome Register 
MCR p15, 4, <Rt>, c5, c1, @; Write Hyp Syndrome Register 


4.3.55 Physical Address Register, EL1 


The PAR ELI characteristics are: 


Purpose 

The Physical Address returned from an address translation. 
Usage constraints 

The accessibility of the PAR ELI by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 
Configurations 
The architectural mapping of the PAR_ EL] is to the Non-secure AArch32 PAR register. 
Attributes 


See the register summary in Table 4-8 AArch64 address translation operations on page 4-81. 


The following figure shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
63 60 59 56 55 44 43 1211109 8 7 6 


conversion completes successfully. 
1 0 
per | AttrL RESO PA RESO a 


Figure 4-48 PAR_EL1 pass bit assignments 





REs1— LNS 
RESO 


The following table shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion completes successfully. 
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Table 4-67 PAR_EL1 pass bit assignments 





Bits Name Function 





[63:60] AttrH Defines Device memory or Normal memory plus Outer cacheability. Must be used in conjunction with AttrL. The 


possible values are: 


@x@ Device memory, see AttrL. 

@x4 Normal memory, Outer Non-cacheable. 

@x8 Normal memory, Outer Write-Through Cacheable. 

@x9 Normal memory, Outer Write-Through Cacheable, Outer Write-Allocate. 

@xA Normal memory, Outer Write-Through Cacheable, Outer Read-Allocate. 

@xB Normal memory, Outer Write-Through Cacheable, Outer Write-Allocate, Outer Read-Allocate. 
@xC Normal memory, Outer Write-Back Cacheable. 

@xD Normal memory, Outer Write-Back Cacheable, Outer Write-Allocate. 

@xE Normal memory, Outer Write-Back Cacheable, Outer Read-Allocate. 








@xF Normal memory, Outer Write-Back Cacheable, Outer Write-Allocate, Outer Read-Allocate. 


All other values are reserved. 





[59:56] AttrL 


Defines Device memory or Normal memory plus Inner cacheability. Must be interpreted in conjunction with AttrH. 
The possible values are: 


@x@ Device-nGnRnE memory if AttrH is @x@. Otherwise this value is reserved. 

@x4 Device memory if AttrH is 0x0. Otherwise, Normal memory, Inner Non-cacheable. 

@x8 Reserved if AttrH is @x0. Otherwise, Normal memory, Inner Write-Through Cacheable. 

@x9 Reserved if AttrH is @x0. Otherwise, Normal memory, Inner Write-Through Cacheable, Inner Write-Allocate. 
@xA_ Reserved if AttrH is @x. Otherwise, Normal memory, Inner Write-Through Cacheable, Inner Read-Allocate. 


@xB Reserved if AttrH is @x@. Otherwise, Normal memory, Inner Write-Through Cacheable, Inner Write-Allocate, 
Inner Read-Allocate. 


@xC_ Reserved if AttrH is @x@. Otherwise, Normal memory, Inner Write-Back Cacheable. 
@xD Reserved if AttrH is Xð. Otherwise, Normal memory, Inner Write-Back Cacheable, Inner Write-Allocate. 
@xE Reserved if AttrH is Xð. Otherwise, Normal memory, Inner Write-Back Cacheable, Inner Read-Allocate. 








@xF Reserved if AttrH is xð. Otherwise, Normal memory, Inner Write-Through Cacheable, Inner Write-Allocate, 
Inner Read-Allocate. 


All other values are reserved. 























[55:44] - Reserved, RESO. 
[43:12] PA Physical address. The Physical Address corresponding to the supplied Virtual Address. Returns address bits[3 1:12]. 
[11] - Reserved, RES1. 
[10] - Reserved, RESO. 
[9] NS Non-secure. The NS attribute for a translation table entry read from Secure state. 
This bit is UNKNOWN for a translation table entry from Non-secure state. 
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Table 4-67 PAR_EL1 pass bit assignments (continued) 





















































Bits Name Function 
[8:7] SHA — Shareability attribute for the Physical Address returned from a translation table entry. The values are: 
ebee Non-shareable. 
@be1 Reserved. 
@b10 Outer Shareable. 
@b11 Inner Shareable. 
Note 
The SHA bit takes the value of @b10 for: 
e Any type of device memory. 
e Normal memory with both Inner Non-cacheable and Outer-cacheable attributes. 
[6:1] - Reserved, RESO. 
[0] F Pass/Fail bit. Indicates whether the conversion completed successfully. This value is: 
0 Virtual Address to Physical Address conversion completed successfully. 
The following figure shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion aborts. 
63 1211109 8 7 6 1 0 
Figure 4-49 PAR_EL1 fail bit assignments 
The following table shows the PAR_EL1 bit assignments when the Virtual Address to Physical Address 
conversion aborts. 
Table 4-68 PAR_EL1 fail bit assignments 
Bits Name Function 
[63:12] - Reserved, RESO. 
[11] - Reserved, RES1. 
[10] - Reserved, RESO. 
[9] S Stage of fault. Indicates the state where the translation aborted. The values are: 
0 Translation aborted because of a fault in stage 1 translation. 
1 Translation aborted because of a fault in stage 2 translation. 
[8] PTW Indicates a stage 2 fault during a stage 1 table walk. The values are: 
0 No stage 2 fault during a stage 1 table walk. 
1 Translation aborted because of a stage 2 fault during a stage 1 table walk. 
[7] - Reserved, RESO. 
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Table 4-68 PAR_EL1 fail bit assignments (continued) 





Bits Name Function 





[6:1] FST Fault status code, as shown in the Data Abort ESR encoding. See the ARM® Architecture Reference Manual ARMv8 
for more information. 





[0] F Pass/Fail bit. Indicates whether the conversion completed successfully. The value is: 


1 Virtual Address to Physical Address conversion aborted. 





To access the PAR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, PAR_EL1; Read EL1 Physical Address Register 
MSR PAR_EL1, <Xt>; Write EL1 Physical Address Register 


Related information 
4.5.18 Physical Address Register on page 4-271. 


4.3.56 Auxiliary Memory Attribute Indirection Register, EL1 and EL3 


The processor does not set any IMPLEMENTATION DEFINED attributes in the Auxiliary Memory Attribute 
Indirection Registers. AMAIR_EL1 and AMAIR_EL3 are RESo. 


AMAIR EL1[31:0] is architecturally mapped to the Non-secure AArch32 AMAIRO register. 
AMAIR EL1[63:32] is architecturally mapped to the Non-secure AArch32 AMAIRI register. 
AMAIR EL3[31:0] is architecturally mapped to the Secure AArch32 AMAIRO register. 
AMAIR EL3[63:32] is architecturally mapped to the Secure AArch32 AMAIRI register. 

The Non-secure and Secure AArch32 AMAIRO and AMAIRI registers are RESO. 


4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 


The processor does not set any IMPLEMENTATION DEFINED attributes in the Auxiliary Memory Attribute 
Indirection Register, EL2. AMAIR_ EL2 is REso. 


AMAIR EL2[31:0] is architecturally mapped to the AArch32 HAMAIRO register. 
AMAIR EL2[63:32] is architecturally mapped to the AArch32 HAMAIRI register. 
The AArch32 HMAIRO and HAMAIR1 registers are RESO. 


4.3.58 L2 Control Register, EL1 
The L2CTLR_ELI characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED control options for the L2 memory system and ECC/parity 
support. There is one L2 Control Register for the Cortex-A72 processor. 
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Usage constraints 
The accessibility to the L2CTLR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





z RW# RWi RW RW RW 








Note 
The L2CTLR_EL1 must be set statically and not dynamically changed. 





The L2 Control Register can only be written when the L2 memory system is idle. ARM 
recommends that you write to this register after a powerup reset before the MMU is enabled and 
before any ACE, CHI, or ACP traffic begins. 


If the register must be modified after a powerup reset sequence, you must idle the L2 memory 

system with the following sequence: 

1. Disable the MMU from each processor followed by an ISB to ensure the MMU disable 
operation is complete, then execute a DSB to drain previous memory transactions. 

2. Ensure that the system has no outstanding AC channel or CHI RXRSP coherence requests to 
the processor. 

3. Ensure that the system has no outstanding ACP requests to the processor. 


When the L2 is idle, the processor can update the L2 Control Register followed by an ISB. After 
the L2 Control Register is updated, you can enable the MMUs and normal ACE or CHI and 
ACP traffic can resume. 


Configurations 
The L2CTLR_EL1 is: 
e Common to the Secure and Non-secure states. 
e A 32-bit register in AArch64 state. 
e Architecturally mapped to the AArch32 L2CTLR register. 


Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 


The following figure shows the L2CTLR_EL1 bit assignments. 





aj Write access if ACTLR_EL3.L2CTLR is 1 and ACTLR_EL2.L2CTLR is 1, or, ACTLR_EL3.L2CTLR is 1 and the Secure SCR.NS is 0. 
ak — Write access if ACTLR_EL3.L2CTLR is 1. 
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31 30 26 25 24 23 22 21 20 19 1413121110 9 8 65 43 2 








L2 Data RAM slice 

L2 Tag RAM slice 
L2 arbitration slice 

— Data inline ECC enable, only applies if ECC is enabled 
ECC and parity enable 

L1 Cache ECC and Parity protection 

RESO 

Number of processors 

L2RSTDISABLE monitor 


a - Data RAM latency 
ee Data RAM setup 
p Tag RAM latency 
L2 Tag RAM setup 























Figure 4-50 L2CTRL_EL1 bit assignments 


The following table shows the L2CTLR_EL1 bit assignments. 


Table 4-69 L2CTLR_EL1 bit assignments 





Bits Name 


Function 





[31] L2RSTDISABLE 
monitor 


Monitors the L2 hardware reset disable signal, LARSTDISABLE. The values are: 


0 L2 valid RAM contents are reset by hardware. 
1 L2 valid RAM contents are not reset by hardware. 


This bit is read-only. The primary input LARSTDISABLE controls the reset value. 





[30:26] - 


Reserved, RESO. 





[25:24] Number of processors 


Number of processors present. These bits are read-only and set to the number of processors 
present in the implementation. The values are: 

b00 One processor, CPUOQ. 

Qbe1 Two processors, CPU0 and CPU1. 

Qb10 Three processors, CPU0, CPU1, and CPU2. 

Q@b11 Four processors, CPU0, CPU1, CPU2, and CPU3. 





[23] L2 Cache protection 


This bit is read-only and is set if the cluster implementation supports L2 cache ECC protection. 
The L2 cache ECC protection is a configurable implementation option in Cortex-A72 cluster. The 
values are: 


0 
L2 cache ECC is not supported. 


L2 cache ECC is supported. 





[22] L1 Cache ECC and Parity 
protection 


This bit is read-only and is set if the processor implementation supports L1 cache ECC and parity 
protection. The L1 cache ECC and parity protection is a configurable implementation option in 
Cortex-A72 processor. The values are: 


0 L1 data cache ECC and L1 instruction cache parity is not supported. 
1 Ll data cache ECC and L1 instruction cache parity is supported. 
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Table 4-69 L2CTLR_EL1 bit assignments (continued) 





Bits Name 


[21] ECC and parity enable 


Function 


ECC and parity enable. The values are: 


0 
Disables ECC and parity. This is the reset value. 


Enables ECC and parity. 


If Cortex-A72 is implemented with L1 Cache ECC and parity protection, L2CTLR[21] can be 
programmed to enable or disable both L1 ECC and parity and L2 ECC protection. 


If Cortex-A72 is implemented with no L1 Cache ECC and parity protection but with L2 ECC 
protection, L2CTLR[21] can be programmed to enable or disable only L2 ECC protection. 


If Cortex-A72 is implemented with neither L1 ECC and parity nor L2 ECC protection, 
L2CTLR[21] is RAZ/WI. 





[20] Data inline ECC enable, 
only applies if ECC is 
enabled 


Force inline ECC for Instruction Fetch (IF) and Load/Store (LS) read requests that hit the L2 
cache increasing the L2 hit latency by 2 cycles. Avoids requirement of flushing requests 
associated with L2 cache single-bit ECC errors. The possible values are: 


0 Performance optimization reducing L2 hit latency by 2 cycles allowing uncorrected data for 
IF and LS read requests that hit the L2 cache. This is the reset value. 


1 Forward only corrected data for L2 cache hits avoiding flushing request for single-bit ECC 
errors. 





[19:14] - 


Reserved, RESO. 





[13] L2 arbitration slice 


L2 arbitration slice. This is a read-only bit that is set if the L2 arbitration slice is present in the 
implementation. The values are: 


0 L2 arbitration slice is not present. 


1 One L2 arbitration slice is present. 





[12] L2 Tag RAM slice 


L2 Tag RAM slice. This is a read-only bit that is set if the Tag RAM slice is present in the 
implementation. The values are: 


0 L2 Tag RAM slice is not present. 
1 One L2 Tag RAM slice is present. 





[11:10] L2 Data RAM slice 


L2 Data RAM slice. These are read-only bits that are set to the number of Data RAM slices 
present in the implementation. The values are: 


@bee L2 Data RAM slices are not present. 
@be1 One L2 Data RAM slice is present. 
@b10 Two L2 Data RAM slices are present. 
@b11 Invalid value. 





[9] L2 Tag RAM setup 


L2 Tag RAM setup. The values are: 








0 0 cycle. This the reset value. 
1 1 cycle. 
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Table 4-69 L2CTLR_EL1 bit assignments (continued) 





Bits Name 


Function 





[8:6] L2 Tag RAM latency 


L2 Tag RAM latency. The L2 Tag RAM programmable setup and latency bits only affect the L2 
Tag RAM. See 7.2.5 Register slice support for large cache sizes on page 7-301 for more 
information. The possible values are: 


@beee 2 cycles. This is the reset value. 
@bee1 2 cycles. 
0b010 3 cycles. 
b011 4 cycles. 
@b1xx 5 cycles. 





[5] L2 Data RAM setup 


L2 Data RAM setup. The values are: 


0 0 cycle. This the reset value. 


1 1 cycle. 





[4:3] - 


Reserved, RESO. 





[2:0] L2 Data RAM latency 


L2 Data RAM latency.*! The L2 Data RAM programmable setup & latency bits affect only the L2 
Data RAM. See 7.2.5 Register slice support for large cache sizes on page 7-301 for more 
information. The values are: 


@beee 

2 cycles. This is the reset value. 
@bee1 

2 cycles. 
b010 

3 cycles. 
b011 

4 cycles. 
b100 

5 cycles. 
b101 

6 cycles. 
0b11x 

6 cycles. 





To access the L2CTLR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, S3_1_c11_c@_2; Read L2 Control Register 
MSR S3_1_c11_c@_2, <Xt>; Write L2 Control Register 


To access the L2CTLR in AArch32 state, read or write the CP15 register with: 


MRC p15, 1, <Rt>, c9, c@, 2; Read L2 Control Register 
MCR p15, 1, <Rt>, c9, c@, 2; Write L2 Control Register 


4.3.59 L2 Extended Control Register, EL1 


The L2ECTLR_EL1 characteristics are: 


Purpose 


Provides additional IMPLEMENTATION DEFINED control options for the L2 memory system. There is 
one L2 Extended Control Register for the Cortex-A72 processor. 





al 


Slice and Set-up have priority over programmed latency in determining total adjusted pipeline depth. 
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Usage constraints 
The accessibility to the L2ECTLR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS=1) EL3(SCR.NS = 0) 





- RWw*™ RW*™ RW*" RW RW 





The LZECTLR_ELI can be written dynamically. 


Configurations 
The LZECTLR_ELI is: 
e Common to the Secure and Non-secure states. 
e A 32-bit register in AArch64 state. 
e Architecturally mapped to the AArch32 L2ZECTLR register. 


Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 
The following figure shows the L2ZECTLR bit assignments. 
31 30 29 28 3 2 0 
LAXI or CHI imprecise bus error L2 dynamic retention control- 
L2 internal asynchronous error 
RESO 


Figure 4-51 L2ECTLR_EL1 bit assignments 
The following table shows the LZECTLR_EL1 bit assignments. 


Table 4-70 L2ECTLR_EL1 bit assignments 











Bits Name Function 
[B1] - Reserved, RESO. 
[30] L2 internal L2 internal asynchronous error caused by L2 RAM double-bit ECC error. The possible values are: 


asynchronous error : 5. 
y 0 No pending asynchronous error. This is the reset value. 


1 An asynchronous error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 





[29] AXI or CHI AXI or CHI asynchronous error indication. The possible values are: 


asynchronous error : fo 
y 0 No pending asynchronous error. This is the reset value. 


1 An asynchronous error has occurred. 


A write of 0 clears this bit. A write of 1 is ignored. 








am Write access if ACTLR_EL3.L2ECTLR is 1 and ACTLR_EL2.L2ECTLR is 1, or ACTLR_EL3.L2ECTLR is 1 and the Secure SCR.NS is 0. 
an Write access if ACTLR_EL3.L2ECTLR is 1. 
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Table 4-70 L2ECTLR_EL1 bit assignments (continued) 





Bits Name Function 





[28:3] - Reserved, RESO. 





[2:0] L2 dynamic retention L2 dynamic retention control. The possible values are: 
control 


ebeee L2 dynamic retention disabled. This is the reset value. 
@bee1 2 Generic Timer ticks required before retention entry. 
@be10 8 Generic Timer ticks required before retention entry. 
@be11 32 Generic Timer ticks required before retention entry. 
@b100 64 Generic Timer ticks required before retention entry. 
@b101 128 Generic Timer ticks required before retention entry. 
@b110 256 Generic Timer ticks required before retention entry. 
@b111 512 Generic Timer ticks required before retention entry. 





To access the L2ECTLR_EL1 in AArch32 state, read or write the CP15 register with: 


MRS <Xt>, S3_1_c11_c0_3; Read L2 Extended Control Register 
MSR S3_1_c11_c@_3, <Xt>; Write L2 Extended Control Register 


To access the L2ECTLR in AArch32 state, read or write the CP15 register with: 


MRC p15, 1, <Rt>, c9, c@, 3; Read L2 Extended Control Register 
MCR p15, 1, <Rt>, c9, c@, 3; Write L2 Extended Control Register 


Related information 
L2 RAMs dynamic retention on page 2-48. 


4.3.60 Reset Vector Base Address, EL3 


The RVBAR_EL3 characteristics are: 


Purpose 
Defines the address that execution starts from after reset when executing in the AArch64 state. 


RVBAR EL3 is part of the reset management registers functional group. 


Usage constraints 
The accessibility of the RVBAR_EL3 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 








- - - - RO RO 
Configurations 
Only implemented if the highest Exception level implemented is EL3. 
Attributes 


See the register summary in Table 4-11 AArch64 reset registers on page 4-82. 
The following figure shows the RVBAR_EL3 bit assignments. 


63 44 43 210 






RESO Reset Vector Base Address 






Figure 4-52 RVBAR_EL3 bit assignments 
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The following table shows the RVBAR_EL3 bit assignments. 


Table 4-71 RVBAR_EL3 bit assignments 





Bits Name Function 





[63:44] - Reserved, RESO. 





[43:2] Reset Vector Base Address Reset Vector Base Address when executing in the AArch64 state. The reset address for processor 
n is set by the RVBARADDRn[43:2] input signals. 





[1:0] - Reserved, RESO. 





To access the RVBAR_EL3 in AArch64 state, read the register with: 


MRS <Xt>, RVBAR_EL3; Read RVBAR_EL3 Reset Vector Base Address Register 


4.3.61 Reset Management Register, EL3 


The RMR_EL3 characteristics are: 


Purpose 

Controls the Execution state that the processor boots into and allows request of a Warm reset. 
Usage constraints 

The accessibility to the RMR_EL3 by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - - RW RW 





Configurations 
The RMR_EL3 is 


e Common to the Secure and Non-secure states. 
e Architecturally mapped to the AArch32 RMR register. 


Attributes 


Write access to RMR_EL3 is disabled when the CPISSDISABLE signal is HIGH and EL3 is 
using AArch32. 


See the register summary in Table 4-11 AArch64 reset registers on page 4-82. 


The following figure shows the RMR_EL3 bit assignments. 


31 2 1 0 


mis“ 
RR— 
AA64 
Figure 4-53 RMR_EL3 bit assignments 
The following table shows the RMR_EL3 bit assignments. 
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Table 4-72 RMR_EL3 bit assignments 





Bits Name Function 





[31:2] - Reserved, RESO. 





[1] RR Reset Request. The values are: 


0 This is the reset value. It is set to zero by either a Cold or Warm reset. 


1 Requests a Warm reset. 





[0] AA64*° Determines the Execution state at processor boot time. The values are: 


0 AArch32 state. 
1 AArch64 state. 


If software requests a Warm reset by setting RR=1 then it can use the AA64 bit to change Execution state. 





To access the RMR_EL3 in AArch64 state, read or write the register with: 


MRS <Xt>, RMR_EL3; Read EL3 Reset Management Register 
MSR RMR_EL3, <Xt>; Write EL3 Reset Management Register 


To access the RMR, in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c12, c@, 2; Read Reset Management Register 
MCR p15, ©, <Rt>, c12, c@, 2; Write Reset Management Register 


4.3.62 Instruction L1 Data n Register, EL1 


The ILIDATAn_ ELI, where n is from 0 to 3, characteristics are: 
Purpose 
Holds the instruction side L1 array information returned by the RAMINDEX system operation. 
Note 


Because all of the I-side arrays are greater than 32-bit wide, the processor contains multiple 
IL1DATA registers, to hold the array information. 








Usage constraints 
The accessibility to the IL1DATAn_ ELI by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Configurations 
The ILIDATAn_EL1 is: 
e Common to the Secure and Non-secure states. 
e A 32-bit register in AArch64 state. 
e Architecturally mapped to the AArch32 IL1DATAn registers. 


Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 


The following figure shows the ILIDATAn_ EL] bit assignments. 





a0 For a Cold reset, the value of this bit is set by the AA64nAA32 signal. 
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31 0 
Figure 4-54 IL1DATA 


The following table shows the ILIDATAn_ EL] bit assignments. 


Table 4-73 IL1DATAn_EL1 bit assignments 





Bits Name Function 





[31:0] Data Holds the instruction side L1 array information 





To access the ILIDATAn_ EL] in AArch64 state, read or write the registers with: 


MRS <Xt>, s3_@c15_c@ nN; Read EL1 Instruction L1 Data n Register 
MSR s3_@_c15_c@_N, <Xt>; Write EL1 Instruction L1 Data n Register 


nis 0, 1, 2, or 3 for Opcode2 of ILIDATAn ELI registers. 
To access the ILIDATAn in AArch32 state, read or write the CP15 registers with: 


MRC p15, ©, <Rt>, c15, c@, N; Read Instruction L1 Data n Register 
MCR p15, ©, <Rt>, c15, c@, N; Write Instruction L1 Data n Register 


nis 0, 1, 2, or 3 for Opcode2 of IL1DATAn registers. 


Related information 
4.3.64 RAM Index operation on page 4-178. 


4.3.63 Data L1 Data n Register, EL1 


The DLIDATAn_ EL}, where n is from 0 to 4, characteristics are: 
Purpose 
Holds the data side L1 or L2 array information returned by the RAMINDEX write operation. 


Note 
Because the Data, Tag, and TLB arrays are greater than 32-bit wide, the processor contains 
multiple DLIDATA registers, to hold the array information. 








Usage constraints 
The accessibility to the DLIDATAn_ ELI by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Configurations 
The DLIDATAn ELl! is: 
e Common to the Secure and Non-secure states. 
e A 32-bit register in AArch64 state. 
e Architecturally mapped to the AArch32 DL1DATAn registers. 


Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 


on page 4-86. 
The following figure shows the DLIDATAn_EL] bit assignments. 
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31 0 
Figure 4-55 DL1DATA 


The following table shows the DL1IDATAn_ ELI bit assignments. 
Table 4-74 DL1DATAn_EL1 bit assignments 





Bits Name Function 





[31:0] Data Holds the data side L1 or L2 array information 





To access the DLIDATAn_ EL] in AArch64 state, read or write the registers with: 


MRS <Xt>, s3_@.c15_c1_n; Read EL1 Data L1 Data N Register 
MSR s3_@ c15_c1_N, <Xt>; Write EL1 Data L1 Data Nn Register 


nis 0, 1, 2, 3, or 4 for Opcode2 of the DLIDATAn_ELI registers. 
To access the DLIDATAn in AArch32 state, read or write the CP15 registers with: 


MRC p15, ©, <Rt>, c15, c1, N; Read Data L1 Data n Register 
MCR p15, ©, <Rt>, c15, c1, N; Write Data L1 Data n Register 


nis 0, 1, 2, 3, or 4 for Opcode2 of the DL1DATAn registers. 


Related information 
4.3.64 RAM Index operation on page 4-178. 


4.3.64 RAM Index operation 


The RAMINDEX characteristics are: 
Purpose 
Read the instruction side L1 array contents into the IL1DATAn register or read the data side L1 
or L2 array contents into the DLIDATAn register. 
Usage constraints 

The accessibility to the RAMINDEX by Exception level is: 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 








- WO WO WO WO WO 





Configurations 
The RAMINDEX operates in the Secure and Non-secure states. 


The RAMINDEX command takes one argument or source register. You must write an ARM 
core register with the bit pattern described in the following figure for each RAM listed in the 


following table. 
A 32-bit register in AArch64 state. 


Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 


on page 4-86. 
The following figure shows the RAMINDEX bit assignments. 
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31 24 23 22 21 18 17 0 


Figure 4-56 RAMINDEX bit assignments 
The following table shows the RAMINDEX bit assignments. 


Table 4-75 RAMINDEX bit assignments 





Bits Name Function 





[31:24] RAMID RAM identifier. This field indicates which RAM is being accessed. The possible values are ®P: 


0x00 L1-I Tag RAM, see L1-I Tag RAM on page 4-180. 

0x01 L1-I Data RAM, see L1-I Data RAM on page 4-180. 

0x02 L1-I BTB RAM, see L1-I BTB RAM on page 4-181. 

0x03 L1-I GHB RAM, see L1-I GHB RAM on page 4-181. 

0x04 L1-I TLB array, see L1-I TLB array on page 4-181. 

0x05 L1-I indirect predictor RAM, see L1-I indirect predictor RAM on page 4-182. 
0x08 L1-D Tag RAM, see L1-D Tag RAM on page 4-183. 

0x09 L1-D Data RAM, see L/-D Data RAM on page 4-183. 

@x@A LI1-D TLB array, see L/-D TLB array on page 4-183. 

@x1@ L2 Tag RAM, see L2 Tag RAM on page 4-184. 

0x11 L2 Data RAM, see L2 Data RAM on page 4-185. 

0x12 L2 Snoop Tag RAM, see L2 Snoop Tag RAM on page 4-186. 
0x13 L2 Data ECC RAM, see L2 Data ECC RAM on page 4-186. 
0x14 L2 Dirty RAM, see L2 Dirty RAM on page 4-187. 

0x18 L2 TLB RAM, see L2 TLB RAM on page 4-187. 


All other values are reserved. 





[23:22] - Reserved, RESO. 





[21:18] Way Indicates the way of the RAM that is being accessed. 





[17:0] Index Indicates the index address of the RAM that is being accessed. 





Note 


¢ Executing a RAMINDEX operation with a reserved value of RAMID, Way, or Index results in the 
corruption of the IL1DATAn or DLIDATAn register contents. 


¢ In Non-secure EL1 and EL2, the RAMINDEX operation returns the contents of the RAM only if the 
entry is marked valid and Non-secure. Entries that are marked invalid or Secure update the 
IL1DATAn or DLIDATAn registers with @x@ values. 

e In Secure EL1 or EL3, the RAMINDEX operation returns the contents of the RAM, regardless of 
whether the entry is marked valid or invalid, and Secure or Non-secure. 

e When the RAMID field is set to L1-I BTB RAM in Non-secure EL1 and EL2, the RAMINDEX 
operation always returns zero. 


¢ The L1-I, L1-D, L2 TLB, and L2 Snoop Tag RAMs can only be accessed by the processor where the 
RAM resides or that owns the RAM. 
¢ The L2 Tag, Data, and Dirty RAMs can be accessed by any processor. 











ap All other values reserved. 
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L1-1 Tag RAM 


The following figure shows the RAMINDEX register bit assignments for accessing L1-I Tag RAM. 


31 24 23 20 19 18 17 14 13 6 5 0 


Figure 4-57 RAMINDEX bit assignments for L1-l Tag RAM 
The RAMINDEX address bits for accessing L1-I Tag RAM are: 
Way[1:0] Way select. 


Note 


The instruction cache is 3-way set-associative. Setting the way field to a value of 3, reads 
way 2 of the cache. 








VA[13:7] Row select. 
VA[6] Bank select. 


The data returned from accessing L1-I Tag RAM are: 


ILDATA1[1] Valid bit. 

ILDATA1[0] Non-secure identifier for the physical address. 
ILDATAO Physical address tag [43:12]. 

L1-I Data RAM 


The following figure shows the RAMINDEX bit assignments for accessing L1-I Data RAM. 


31 24 23 20 19 18 17 1413 3 2 0 
L- Reserved 


Figure 4-58 RAMINDEX bit assignments for L1-I Data RAM 
The RAMINDEX address bits for accessing L1-I Data RAM are: 
Way[1:0] Way select. 


Note 


The instruction cache is 3-way set-associative. Setting the Way field to 3, reads way 2 of the 
cache. 





VA[13:6] Set select. 
VA[5:4] Bank select. 
VA[3] Upper or lower doubleword within the quadword. 


The data returned from accessing L1-I Data RAM are: 





ILDATA1[31:0] Data word 1. 
ILDATAO[31:0] Data word 0. 
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L1-1 BTB RAM 


The following figure shows the RAMINDEX bit assignments for accessing L1-I BTB RAM. 


31 24 23 15 14 4 


3 0 


Figure 4-59 RAMINDEX bit assignments for L1-| BTB RAM 
The RAMINDEX address bits for accessing L1-I BTB RAM are: 


VA[14:6] Row select. 
VA[5:4] Bank select. 


ARM does not disclose the format of the returned data. 


L1-1 GHB RAM 


The following figure shows the RAMINDEX bit assignments for accessing L1-I GHB RAM. 


31 24 23 16 15 4 


3 0 


Figure 4-60 RAMINDEX bit assignments for L1-l GHB RAM 
The RAMINDEX address bits for accessing L1-I GHB RAM are: 


Index[15:5] 

Row select. 
Index[4] 

Bank select. 


ARM does not disclose the format of the returned data. 


L1-1 TLB array 


The following figure shows the RAMINDEX bit assignments for accessing L1-I TLB array. 


31 24 23 6 


5 0 


Figure 4-61 RAMINDEX bit assignments for L1-I TLB array 
The RAMINDEX address bits for accessing L1-I TLB array are: 
TLB entry Selects one of the 48 entries. 


The data returned from accessing L1-I TLB array are: 





ILDATA3[27] Valid bit. 
ILDATA3[26:25] Shareability attribute: 
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bee 
Non-Shareable. 
Q@be1 
Reserved. 
0b10 
Outer Shareable. 
0b11 
Inner Shareable. 
ILDATA3[15:14] VA memory space ID: 
b00 
Secure EL1. 
b01 
EL3, AArch64 only. 
0b10 
Non-secure EL1. 
0b11 
Non-secure EL2. 
ILDATA3[13:6] Virtual Machine ID (VMID). 
{ILDATA3[5:0], ILDATA2[31:22]} Address Space ID (ASID). 
ILDATA2[21:14] Memory Attribute Indirection Register. 
ILDATA2[11:10] Page size: 
b00 
4KB. 
Q@be1 
64KB. 
0b10 
1MB. 
0b11 
Reserved. 
ILDATA2[9:6] Domain ID. 
ILDATA2[5] Non-secure identifier for the physical address. 
{ILDATA2[4:0], ILDATA1[31:5]} Physical address [43:12]. 
{ILDATA1[4:0], ILDATAO0[31:0]} Virtual address [48:12]. 


L1-l indirect predictor RAM 


The following figure shows the RAMINDEX bit assignments for accessing L1-I indirect predictor RAM. 


31 24 23 19 18 17 8 7 0 
l- Way 


Figure 4-62 RAMINDEX bit assignments for L1-I indirect predictor RAM 
The RAMINDEX address bits for accessing L1-I indirect predictor RAM are: 


Way Way select. 
Index[7:0] Indirect predictor entry. 


ARM does not disclose the format of the returned data. 
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L1-D Tag RAM 


The following figure shows the RAMINDEX bit assignments for accessing L1-D Tag RAM. 


24 23 191817 14 13 0 
l- Way 


Figure 4-63 RAMINDEX bit assignments for L1-D Tag RAM 
The RAMINDEX address bits for accessing L1-D Tag RAM are: 


Way Way select. 
PA[13:8] Row select. 
PA[7:6] Bank select. 


The data returned from accessing L1-D Tag RAM are: 
DL1DATA1[1:0] MESI state: 


e@bee Invalid. 
@be1 Exclusive. 
@b10 Shared. 
@b11 Modified. 


DL1IDATAO[30]_  Non-secure identifier for the physical address. 
DL1DATAO[29:0] Physical address tag [43:14]. 


L1-D Data RAM 
The following figure shows the RAMINDEX bit assignments for accessing L1-D Data RAM. 


24 23 191817 14 13 
RAMID = 0x09 | Reset | | Unie | Physical address [13:31 T: 
L- way L Reserved 


Figure 4-64 RAMINDEX bit assignments for L1-D Data RAM 
The RAMINDEX address bits for accessing L1-D Data RAM are: 


Way Way select. 

PA[13:6] Set select. 

PA[5:4] Bank select. 

PA[3] Upper or lower doubleword within the quadword. 


The data returned from accessing L1-D Data RAM are: 


DL1DATA1[31:0] Data word 1. 
DL1DATA0[31:0] Data word 0. 


L1-D TLB array 


The following figure shows the RAMINDEX bit assignments for accessing L1-D TLB array. 
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31 


24 23 


The RAMINDEX address bits for accessing L1-D TLB array are: 


TLB entry 


Selects one of the 32 entries. 


The data returned from accessing L1-D TLB array are: 
DL1IDATA3[12] 


DL1IDATA3/[11:10] 


DL1DATA3{1:0] 


DL1IDATA2[31:24] 
DLIDATA2[23:22] 


DL1IDATA2[21:18] 


DL1DATA2[5] 
{DL1IDATA2[4:0], DLIDATA1[31:5]} 
{DL1DATA1[4:0], DLIDATA0[31:0]} 


L2 Tag RAM 


4 System Control 
4.3 AArch64 register descriptions 


5 4 0 


Figure 4-65 RAMINDEX bit assignments for L1-D TLB array 


Valid bit. 
VA memory space ID: 
b00 

Secure EL1. 
Q@be1 

EL3, AArch64 only. 
0b10 

Non-secure EL1. 
0b11 

Non-secure EL2. 
Shareability attribute: 
Q@bee 

Non-Shareable. 
@be1 

Reserved. 
0b10 

Outer Shareable. 
0b11 


Inner Shareable. 


Memory Attribute Indirection Register. 


Page size: 
Qbee 

4KB. 
@be1 

64KB. 
0b10 

1MB. 
0b11 

Reserved. 
Domain ID. 


Non-secure identifier for the physical address. 


Physical address [43:12]. 
Virtual address [48:12]. 


The following figure shows the RAMINDEX bit assignments for accessing L2 Tag RAM. 
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24 23 22 21 18 17 16 0 


RAMID = 0x10 fow Physical address [16:61 


Reserved — Reserved — 
Figure 4-66 RAMINDEX bit assignments for L2 Tag RAM 
The RAMINDEX address bits for accessing L2 Tag RAM are: 


Way[3:0] Way select. 
PA[16:7] Row select. 
PA[6] Tag bank select. 


The data returned from accessing L2 Tag RAM are: 
DL1IDATAO[31]_ | Non-secure identifier for the physical address. 
DL1DATAO0[30:2] Physical address tag [43:15]. 
DL1IDATAO[1:0] MOESI state: 


ebee 
Invalid. 
@be1 
Exclusive or Modified. 
b10 
Reserved. 
b11 
Shared or Owned. 
Note 


The Dirty bit in the L2 Dirty RAM must be used to differentiate between the 
Exclusive, Modified, Shared, and Owned states. 





L2 Data RAM 


The following figure shows the RAMINDEX bit assignments for accessing L2 Data RAM. 


24 23 22 21 18 17 16 4 3 0 


RAMID = 0x11 EKEJI Physical address [16:4] 


Reserved — Reserved — 


Figure 4-67 RAMINDEX bit assignments for L2 Data RAM 
The RAMINDEX address bits for accessing L2 Data RAM are: 


Way[3:0] Way select. 
PA[16:7] Row select. 
PA[6] Tag bank select. 
PA[5:4] Data bank select. 


The data returned from accessing L2 Data RAM are: 





DLIDATA3 Data 127:96]. 
DLIDATA2 Data[95:64]. 
DLIDATAI Data[63:32]. 
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DLIDATAO Data[31:0]. 


L2 Snoop Tag RAM 


The following figure shows the RAMINDEX bit assignments for accessing L2 Snoop Tag RAM. 


31 2423 2120191817 14 13 6 5 0 





i |_way 
Reserved 


Figure 4-68 RAMINDEX bit assignments for L2 Snoop Tag RAM 


The RAMINDEX address bits for accessing L2 Snoop Tag RAM are: 
CPUID[1:0] Processor ID of the executing processor that has access to the L2 Snoop Tag RAM. 


Way Way select. 
PA[13:7] Row select. 
PA[6] Bank select. 


The data returned from accessing L2 Snoop Tag RAM are: 


DLIDATA1[0] Non-secure identifier for the physical address. 
DLIDATAO[31:2] Physical address tag [43:14]. 
DLIDATAO[1:0] MESI state: 
@bee 
Invalid. 
@be1 
Exclusive or Modified. 
@b10 
Reserved. 
@b11 
Shared. 


L2 Data ECC RAM 


The following figure shows the RAMINDEX bit assignments for accessing L2 Data ECC RAM. 


31 24 23 22 21 18 17 16 4 3 0 


RAMID = 0x13 pf way | Physical address [16:4] 


Reserved zi Reserved zl 


Figure 4-69 RAMINDEX bit assignments for L2 Data ECC RAM 
The RAMINDEX address bits for accessing L2 Data ECC RAM are: 


Way[3:0] Way select. 
PA[16:7] Row select. 
PA[6] Tag bank select. 
PA[5:4] Data bank select. 


ARM does not disclose the format of the returned data. 
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L2 Dirty RAM 


The following figure shows the RAMINDEX bit assignments for accessing L2 Dirty RAM. 


31 24 23 22 21 18 17 16 6 5 0 


RAMID = 0x14 EKEJI Physical address [16:61 


Reserved al Reserved =l 
Figure 4-70 RAMINDEX bit assignments for L2 Dirty RAM 
The RAMINDEX address bits for accessing L2 Dirty RAM are: 


Way[3:0] Way select. 
PA[16:7] Row select. 
PA[6] Tag bank select. 


The data returned from accessing L2 Dirty RAM are: 


DLIDATAO[7]| Outer Shareable page attribute. 
DLIDATAO[6] Read Allocate page attribute. 
DLIDATAO[5] Write Allocate page attribute. 
DLIDATAO[4] Inner Shareable page attribute. 
DLIDATAO[0] Dirty bit indicator. 

L2 TLB RAM 


The following figure shows the RAMINDEX bit assignments for accessing L2 TLB RAM. 


31 24 23 20 19 18 17 8 7 0 


Figure 4-71 RAMINDEX bit assignments for L2 TLB RAM 
The RAMINDEX address bits for accessing L2 TLB RAM are: 


Way Way select. 
TLB entry Selects one of the 256 entries in each way. 


The data returned from accessing L2 TLB RAM are: 


DLIDATA3[31] Valid bit for EL3 AArch64 only. 

DL1DATA3[30] Valid bit for EL2. 

DL1DATA3[29] Valid bit for Secure EL1. 

DLIDATA3 [28] Valid bit for Non-secure EL1. 
Note 





Only a single bit in DLDATA3[31:28] is set to 1. 





DL1DATA3[27:20] VMID. 
DL1DATA3[19:4] ASID. 
{DL1DATA3[3:0], Virtual address [48:19]. 


DL1DATA2[31:6]} 
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DL1DATA2[5] 


{DL1IDATA2[4:0], 
DL1DATA1[31:5]} 
{DL1IDATA1[1:0], 
DLIDATAOJ[31]} 


DLIDATA0[13:10] 
DLIDATA0[9:8] 


DL1IDATAO[7:0] 
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Non-secure identifier for the physical address. 


Physical address [43:12]. 


Fully resolved page size: 


@beee 4KB. 
0b001 64KB. 
0b010 1MB. 
0b011 2MB. 
b100 16MB. 
@b101 512MB. 
0b110 1GB. 
Domain ID. 

Shareability attribute: 

@bee Non-Shareable. 
@be1 Reserved. 

@b10 Outer Shareable. 
@b11 Inner Shareable. 


Memory Attribute Indirection Register. 


For example, to read an entry in the instruction side TLB in AArch64 state: 


LDR XO, =0x0000000001000D80 


SYS #0, c15, c4, #0 
DSB SY 
ISB 


MRS X1, S3_0_c15_c0 _@ ; 
MRS X2, S3_0_c15_c0_1 ; 

_2 ; Move 
MRS X4, S3_0_c15_c0 3 ; 


MRS X3, S3_0_ c15 c0 


, XO 


Move 
Move 


Move 


ILData®ð 
ILData1 
ILData2 
ILData3 


register to X1 
register to X2 
register to X3 
register to X4 


To complete the RAMINDEX operation in AArch64 state, use the following instruction: 


SYS #0, c15, c4, #0, X@ ; Execute RAMINDEX operation 


For example, to read one entry in the instruction side L1 data array in AArch32 state: 


LDR RO, =0x01000D80 
MCR p15, @, RƏ, c15 
DSB 

ISB 

MRC p15, @, R1, c15 
MRC p15, @, R2, c15 
MRC p15, @, R3, c15 


$ 


3 c4, ð; 


» CO, 0; 
» C®, 1; 
» C0, 2; 


Read I-L1 TLB data into IL1DATAQ-2 


Move IL1DATA@ Register to R1 
; Move IL1DATA1 Register to R2 
Move IL1DATA2 Register to R3 


To complete the RAMINDEX operation in AArch32 state, use the following instruction: 


MCR p15, ©, <Rt>, c15, c4, @; Execute RAMINDEX operation 


4.3.65 L2 Auxiliary Control Register, EL1 
The LZACTLR_ ELI characteristics are: 


Purpose Provides IMPLEMENTATION DEFINED configuration and control options for the L2 memory 
system. There is one L2 Auxiliary Control Register for the Cortex-A72 processor. 
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Usage 
constraints 


Configurations 


Attributes 


4 System Control 
4.3 AArch64 register descriptions 


The accessibility to the LAACTLR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RW“ RW® RW* RW RW 





Note 
The LZACTLR_EL1 must be set statically and not dynamically changed. 








The L2 Auxiliary Control Register can only be written when the L2 memory system is 
idle. ARM recommends that you write to this register after a powerup reset, before the 
MMU is enabled, and before any ACE, CHI, or ACP traffic begins. 


If the register must be modified after a powerup reset sequence, you must to idle the 

L2 memory system with the following sequence: 

1. Disable the MMU from each core followed by an ISB to ensure the MMU disable 
operation is complete, then execute a DSB to drain previous memory transactions. 

2. Ensure that the system has no outstanding ACE AC channel or CHI RXRSP 
coherence requests to the Cortex-A72 processor. 

3. Ensure that the system has no outstanding ACP requests to the Cortex-A72 
processor. 


When the L2 is idle, the processor can update the L2 Auxiliary Control Register 
followed by an ISB. After the L2 Auxiliary Control Register is updated, you can 
enable the MMUs and normal ACE or CHI and ACP traffic can resume. 


The L2ACTLR_ELI is: 
e Common to the Secure and Non-secure states. 


e A 32 bit register in AArch64 state. 
e Architecturally mapped to the AArch32 L2ZACTLR register. 


See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 


The following figure shows the LAACTLR_EL1 bit assignments. 





aq Write access if ACTLR_EL3.L2ACTLR is 1 and ACTLR_EL2.L2ACTLR is 1, or ACTLR_EL3.L2ACTLR is 1 and the Secure SCR.NS is 0. 
al Write access if ACTLR_EL3.L2ACTLR is 1. 
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31 30 29 28 27 26 25 24 23 22 21 20191817161514131211109 8 76543 210 


L2 PLRU insertion point — a 
L2 replacement policy 


Force L2 tag banks clock enable active 

Force L2 logic clock enable active 

Force L2, GIC, Timer RCG enables active 
Enable single issue across all tonks when 

L2 arbitration replay threshold is reached 

L2 PLRU mode — 

Disable ACP MakeUnique and WriteLineUnique transactions 














Disable dynamic throttling of LS prefetch requests 





RESO— 





Disable limit on NC/SO/Dev stores in Address Sequence Queue (ASQ)— 


Disable L2 round-robin arbitration that only clocks through _| 
paths with an active requestor waiting to be arbitrated 











Enable replay threshold single issue 

Disable fast forwarding of data from ACE or CHI to LS and IF 
Enable UniqueClean evictions with data 

Disable clean evict optimization 

Disable prefetch set hazard optimization —————————! 

Disable DSB with no DVM-sync — 

Disable Non-secure debug array access 

Disable set/way hazard optimization on back to back read requests from same CPU 
Disable DVM/CMO message broadcast 

Enable hazard-detect timeout 

Disable ACE shareable or CHI snoopable transactions from master 

Disable set/way hazard optimization for WBNA/WT memory 

Disable WriteUnique and WriteLineUnique transactions from master — 

Disable clean/evict push to external 

Limit to one request per tag bank 

Enable arbitration replay threshold timeout 

Disable hardware prefetch forwarding 



























































Figure 4-72 L2ACTLR_EL1 bit assignments 
The following table shows the LZACTLR_ELI bit assignments. 


Table 4-76 L2ACTLR_EL1 bit assignments 





Bits Name Function 





(31:30]*S L2 PLRU insertion point Selects the L2 PLRU insertion point: 
00 Insert new lines midway between MRU and LRU positions. This is the reset value. 
01 Insert new lines at MRU position. 
10 Insert new lines at 3/4 LRU position. 


11 Insert new lines at LRU position. 





[29]®s L2 replacement policy Selects the L2 cache replacement policy: 
0 Pseudo Least Recently Used (PLRU). This is the reset value. 


1 Pseudo random 
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Table 4-76 L2ACTLR_EL1 bit assignments (continued) 





Bits 


[28]"s 


Name Function 


Force L2 tag bank clock enable Forces L2 tag bank clock enable active: 


active 0 Does not prevent the clock generator from stopping the L2 tag bank clock. This is 
the reset value. 


1 Prevents the clock generator from stopping the L2 tag bank clock. 
This bit applies to each of the two L2 cache tag bank clocks. 


See Z2 control and tag banks clock gating on page 2-49. 


If the L2 dynamic retention feature is used then this bit must be zero. See L2 RAMs 
dynamic retention on page 2-48. 





pur 


Force L2 logic clock enable Forces L2 logic clock enable active: 


AGN 0 Does not prevent the clock generator from stopping the L2 logic clock. This is the 


reset value. 


1 Prevents the clock generator from stopping the L2 logic clock. 


See L2 control and tag banks clock gating on page 2-49. 


If the L2 dynamic retention feature is used then this bit must be zero. See L2 RAMs 
dynamic retention on page 2-48. 





[26]*s 


Force L2, GIC, Timer RCG Forces L2, GIC CPU interface, and Timer Regional Clock Gate (RCG) enables active: 


enables Active 0 Enables L2, GIC CPU interface, and Timer RCGs for additional clock gating and 


potentially reduce dynamic power dissipation. This is the reset value. 
1 Forces L2, GIC CPU interface, and Timer RCG enables HIGH. 


Setting this bit to 1 has no effect if the processor is configured to not include RCGs. See 
Regional clock gating on page 2-50. 





ps 


Enable single issue across all Enables single issue across all tag banks when the L2 arbitration replay threshold is 
tbnks when L2 arbitration replay reached, so that only one request can be active across both tag banks at any given time: 


tnesholl 1. reached 0 Disables single issue across the tag banks when the L2 arbitration replay threshold is 


reached. This is the reset value. 
1 Enables single issue across the tag banks when the L2 arbitration replay threshold is 
reached. 





[24] 


L2 PLRU mode Disables PLRU dynamic insertion and update policy: 


0 Enables PLRU dynamic insertion and update policy. This is the reset value. 
1 Disables PLRU dynamic insertion and update policy. 





[23]* 


Disable ACP MakeUnique and Disables ACP MakeUnique and WriteLineUnique transactions: 


Wn ae Unique transactions 0 Enables MakeUnique and WriteLineUnique transactions for full cache line ACP 


writes with all byte enables asserted. This is the reset value. 
1 Disables MakeUnique and WriteLineUnique transactions for full cache line ACP 
writes with all byte enables asserted. 








as 


This bit is provided for debugging and characterization purpose only. For normal operation, ARM recommends that you do not change the value of this bit from its 
reset value. 
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Table 4-76 L2ACTLR_EL1 bit assignments (continued) 





























Bits Name Function 
[22]** Disable dynamic throttling of Disables dynamic throttling of load/store prefetch requests: 
loadstore prefetch requests 0 Enables dynamic throttling of load/store prefetch requests. This is the reset value. 
1 Disables dynamic throttling of load/store prefetch requests. 
[21:20] - Reserved, RESO. 
[19:18] Disable limit on NC/SO/Dev Disables limit on NC/SO/Dev stores in ASQ: 
pie es Sequence 00 NC/SO/Dev stores limited to 12 entries in the ASQ. This is the reset value. 
ueue 

01 NC/SO/Dev stores limited to 10 entries in the ASQ. 

10 NC/SO/Dev stores limited to 8 entries in the ASQ. 

11 There is no limit on NC/SO/Dev stores in the ASQ. 

[17]®s Disable L2 round-robin Disable L2 round-robin arbitration that only clocks through paths with an active 
arbitration that only clocks requestor waiting to be arbitrated: 
through p ane wae - ee d Enables L2 round-robin arbitration that only clocks through paths with an active 
teguestor Waiting 10/07 arortrate requestor waiting to be arbitrated. This is the reset value. 

1 Disables L2 round-robin arbitration that only clocks through paths with an active 
requestor waiting to be arbitrated. 

[16]®s Enable replay threshold single Enables replay threshold single issue: 
ee 0 Disables replay threshold single issue. This is the reset value. 

1 Enables replay threshold single issue. If there are 32 consecutive transactions on a 
tag bank replay, then single issue is forced until a transaction successfully passes 
hazard checking. 

[15]** Disable fast forwarding of data Disables fast forwarding of data from ACE or CHI to LS and IF: 
Tomi AC Rior CHIO LS and IE 0 Enables fast forwarding of data from ACE or CHI to LS and IF. This is the reset 
value. 

1 Disables fast forwarding of data from ACE or CHI to LS and IF. 

[14] Enable UniqueClean evictions Enables UniqueClean evictions with data: 
h dato 0 Disables UniqueClean evictions with data. This is the reset value if the 
multiprocessor implements the ACE interface. 

1 Enables UniqueClean evictions with data. This is the reset value if the 
multiprocessor implements the CHI interface. 

[13]® Disable clean evict optimization Disables clean evict optimization: 
0 Enables clean evict optimization. This is the reset value. 
1 Disables clean evict optimization. 
12 Disable prefetch set hazard Disables set hazard optimization against prefetch entries. 
P 


optimization 


0 Enables set hazard optimization, preventing a set hazard for prefetch entries. This is 
the reset value. 


1 Disables set hazard optimization against prefetch entries. 
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Table 4-76 L2ACTLR_EL1 bit assignments (continued) 


























Bits Name Function 

[11]*s Disable DSB with no DVM Disables Data Synchronization Barrier (DSB) with no Distributed Virtual Memory 
synchronization (DVM) synchronization: 

0 Enables DSB with no DVM synchronization. This is the reset value. 
A DSB does not cause a DVM Sync message to occur. However, if a TLB 
maintenance operation, cache maintenance operation, or branch predictor 
maintenance operation occurs after the previous DSB then a DVM Sync message is 
generated regardless of the setting of this bit. 

1 Disables DSB with no DVM synchronization. Therefore, a DSB always causes a 
DVM Sync message to occur. 

[10] Disable Non-secure debug array Disables Non-secure debug array read: 
tead 0 Enables Non-secure debug array read access to Non-secure memory. This is the reset 

value. 
1 Disables Non-secure debug array read access. 

[9] Disable set/way hazard Disables set/way hazard optimization on back to back reads from the same CPU 
optimization on back to back targeting the same set: 
tread requests trom same CPU 0 Enables set/way hazard optimization. This is the reset value. 

1 Disables set/way hazard optimization. 

[8] Disable DVM and cache Disables DVM transactions and cache maintenance operation message broadcast: 
came ia Operation: Message 0 Enables DVM and cache maintenance operation message broadcast. This is the reset 
broadcast 

value. 
1 Disables DVM and cache maintenance operation message broadcast. 

[7]® Enable hazard detect timeout Enables hazard detect timeout: 

0 Disables hazard detect timeout. This is the reset value. 
1 Enables hazard detect timeout. 

[6]® Disable ACE shareable or CHI Disables shareable or snoopable transactions from master: 
snoopable transactions from 0 Enables ACE shareable or CHI snoopable transactions from master. This is the reset 
master value. 

1 Disables ACE shareable or CHI snoopable transactions from master. 
5j” Disable set/way hazard Disables set/way hazard optimization for WBNA/WT memory: 
y: 
optimization for WBNA/WT AOE : a 
0 Enables optimization removing set/way hazard for WBNA/WT memory. This is the 
memory 
reset value. 
1 Disables optimization for forcing set/way hazard for WBNA/WT memory. 
[4] Disable WriteUnique and Disables WriteUnique and WriteLineUnique transactions from master: 


WriteLineUnique transactions 
from master 


0 Enables WriteUnique and WriteLineUnique transactions from master. 


1 Disables WriteUnique and WriteLineUnique transactions from master. This is the 
reset value. 
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Table 4-76 L2ACTLR_EL1 bit assignments (continued) 








Bits Name Function 
[3] Disable clean/evict push to Disables clean/evict push to external: 
external 


0 Enables clean/evict to be pushed out to external. This is the reset value if the 
processor implements the ACE interface. 


1 Disables clean/evict from being pushed to external. This is the reset value if the 
processor implements the CHI interface. 





BRI” Limit to one request per tag bank Limit to one request per tag bank: 


0 Normal behavior permitting parallel requests to the tag banks. This is the reset value. 


1 Limits to one request per tag bank. 





[je Enable arbitration replay Enables arbitration replay threshold timeout: 


threshold timisout 0 Disables arbitration replay threshold timeout. This is the reset value. 


1 Enables arbitration replay threshold timeout. 





[0}*s Disable hardware prefetch Disables hardware prefetch forwarding: 


forwarding 0 Enables hardware prefetch forwarding. This is the reset value. 


1 Disables hardware prefetch forwarding. 





To access the L2ACTLR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, s3_1_c15_c@ _@; Read EL1 L2 Auxiliary Control Register 
MSR s3_1_c15_c0_0, <Xt>; Write EL1 L2 Auxiliary Control Register 


To access the L2ACTLR in AArch32 state, read or write the CP15 register with: 


MRC p15, 1, <Rt>, c15, c@, @; Read L2 Auxiliary Control Register 
MCR p15, 1, <Rt>, c15, c0, @; Write L2 Auxiliary Control Register 


4.3.66 CPU Auxiliary Control Register, EL1 


The CPUACTLR_ELI characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED configuration and control options for the processor. There is 
one 64-bit CPU Auxiliary Control Register for each core in the cluster. 
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Usage constraints 
The accessibility to the CPUACTLR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS=1) EL3(SCR.NS = 0) 





- RW" RW" RW" RW RW 





The CPU Auxiliary Control Register can only be written when the system is idle. ARM 


recommends that you write to this register after a powerup reset, before the MMU is enabled, 
and before any ACE or ACP traffic begins. 


Note 


Setting many of these bits can cause significantly lower performance on your code. Therefore, it 
is suggested that you do not modify this register unless directed by ARM. 








Configurations 
CPUACTLR_ ELI is: 


e Common to the Secure and Non-secure states. 
e A 64-bit read/write register. 
e Architecturally mapped to the AArch32 CPUACTLR register. 
Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 


The following figure shows the CPUACTLR_EL1[63:32] bit assignments. 





at Write access if ACTLR_EL3.CPUACTLR is 1 and ACTLR_EL2.CPUACTLR is 1, or ACTLR_EL3.CPUACTLR is 1 and SCR.NS is 0. 


au Write access if ACTLR_EL3.CPUACTLR is 1. 
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63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 






































Treat 
Treat 


























Treat 









































Disab 
=~ Disab 
Disab! 
Disab! 
Disab! 
~ Disab 


Disab! 
Disab! 


Disab! 
Disab! 
Force processor Dispatch idle RCG enables active 

Force processor Decode and Integer Execute idle RCG enables active 
Force processor non-memory-system RCG enables active 

Force processor memory-system RCG enables active 


L Disable Instruction Cache prefetch 
Disable main prediction suppression 
at target fetch of microBTB 
Disable static branch predictor 


Disable ISB optimization 
Force implicit DSB on an ISB 
Disable instruction group split 
Force FPSCR write flush 
~~~ — Disable instruction merging 
—RES0 
Enable snoop hazard while waiting for the second half of atomic exclusive pair 
Disable prefetch requests from ReadUnique transactions 
Disable VA based hardware prefetch 
Execute Data Cache clean as Data Cache clean/invalidate 
Disable L1 Data Cache way tracker 
Disable multiple outstanding L1 Data TLB misses and L2 TLB hit under miss 
e D-side L1/L2 hardware prefetch across 4KB page boundary even if page is 64KB or larger 
le early speculative read access from LS to L2 
e non-allocate hint of Write-Back No-Allocate memory type 
le store streaming on NC/GRE memory type 
le contention detection and fast exclusive monitor path 
e over-read from LDNP instruction 
DMB/DSB as if their domain field is SY 
GRE/nGRE as nGnRE 
e load pass store 
e Load-store hardware prefetcher 
DMB st/st and Id/all as DMB all/all. Treat DSB st/st and Id/all as DSB all/all 
e DMB nullification 
le load pass DMB 























Figure 4-73 CPUACTLR_EL1[63:32] bit assignments 


The following table shows the CPUACTLR_EL1[63:32] bit assignments. 
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Table 4-77 CPUACTLR_EL1[63:32] bit assignments 








Bits Name Function 
[63]? Force processor memory- Forces processor memory-system RCG enables active: 
system RCG enables active 0 
Enables the processor memory-system RCGs for additional clock gating and 
potentially reduce dynamic power dissipation. This is the reset value. 
1 


Forces the processor memory-system RCG enables HIGH. 


Setting this bit to 1 has no effect if the processor is configured to not include RCGs. See 
Regional clock gating on page 2-50. 





[62]*” Force processor non- Forces processor non-memory-system RCG enables active: 
memory-system RCG 0 
çnablesachys Enables the processor non-memory-system RCGs for additional clock gating and 
potentially reduce dynamic power dissipation. This is the reset value. 
1 


Forces the processor non-memory-system RCG enables HIGH. 


Setting this bit to 1 has no effect if the processor is configured to not include RCGs. See 
Regional clock gating on page 2-50. 





[61]? Force processor Decode and Forces processor Decode and Integer Execute idle RCG enables active: 
Integer Execute idle RCG 
enables active 


0 
Enables the processor Decode and Integer Execute idle RCGs for additional clock 
gating and potentially reduce dynamic power dissipation. This is the reset value. 


Forces the processor Decode and Integer Execute idle RCG enables HIGH. 


Setting this bit to 1 has no effect if the processor is configured to not include RCGs. See 
Regional clock gating on page 2-50. 





[60]? Force processor Dispatch Forces processor Dispatch idle RCG enables active: 


idle RCG enables active 0 


Enables the processor Dispatch idle RCGs for additional clock gating and potentially 
reduce dynamic power dissipation. This is the reset value. 


Forces the processor Dispatch idle RCG enables HIGH. 


Setting this bit to 1 has no effect if the processor is configured to not include RCGs. See 
Regional clock gating on page 2-50. 





[59]*" Disable load pass DMB Disables load pass DMB. This does not include the implicit barrier from Load-Acquire and Load- 
Acquire Exclusive. The possible values are: 


0 
Enables load pass DMB. This is the reset value. 


Disables load pass DMB. 








aV This bit is used internally for debugging and characterization purposes only. For normal operation, ARM recommends that you do not change the value of this bit 
from its reset value. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 4-197 
Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


Table 4-77 CPUACTLR_EL1[63:32] bit assignments (continued) 























Bits Name Function 
([58]°” Disable DMB nullification Disables DMB nullification. This includes the implicit barrier from Store-Release and Store- 
Release Exclusive: 
0 
Enables DMB nullification. This is the reset value. 
1 
Disables DMB nullification. 
(57]*Y Treat DMB st/st andDMB- Treats DMB st/st and DMB 1ld/allas DMB all/all. Treat DSB st/st andDSB 1d/allas 
ld/all as DMB all/all. DSB all/all. This does not include the implicit barrier from Load-Acquire/Store-Release. The 
Treat DSB st/st and psp Possible values are: 
Id/allasDSB all/all. 0 
Normal behavior. This the reset value. 
1 
e TreatDMB st/st and DMB 1d/allas DMB all/all. 
e TreatDSB st/standDSB 1ld/allasDSB all/all. 
[56]°” Disable Load-store Disables Load—store hardware prefetcher: 
hardware prefetcher 0 
Enables Load-store hardware prefetcher. This the reset value. 
1 
Disables Load-store hardware prefetcher. 
[55]*” Disable load pass store Disables load pass store: 
0 
Enables load pass store. This the reset value. 
1 
Disables load pass store. 
[54]°” Treat GRE/nGRE as nGnRE Treat GRE and nGRE as nGnRE: 
0 
Enables optimization for GRE and nGRE load/store. This is the reset value. 
1 
Treats GRE and nGRE as nGnRE. Disables optimization for GRE and nGRE load/ 
store. 
[53]°” Treat DMB and DSB as if Treats DMB and DSB as if their domain field is SY. The possible values are: 
their domain field is SY 0 
Normal behavior. This is the reset value. 
1 
Treat DMB NSH, DMB ISH, and DMB OSH as DMB SY. 
Treat DSB NSH, DSB ISH, and DSB OSH as DSB SY. 
([52]*” Disable over-read from Disables over-read from LDNP instruction: 


LDNP instruction 


0 
Enables the over-read from LDNP instruction. This is the reset value. 


Disables the over-read from LDNP instruction. 
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Table 4-77 CPUACTLR_EL1[63:32] bit assignments (continued) 























Bits Name Function 
[51]? Enable contention detection Enables contention detection and fast exclusive monitor path: 
and fast exclusive monitor 0 
path Disables contention detection and fast exclusive monitor path. This is the reset value. 
1 
Enables contention detection and fast exclusive monitor path. 
[50]?°" Disable store streaming on Disables store streaming on NC/GRE memory type: 
NC/GRE memory type 0 
Enables store streaming on NC/GRE memory type. This is the reset value. 
1 
Disables store streaming on NC/GRE memory type. 
[49]? Disable non-allocate hint of Disables non-allocate hint of Write-Back No-Allocate memory type: 
Write-Back No-Allocate 0 
(WBNA) memory type Enables non-allocate hint of WBNA memory type. This is the reset value. 
1 
Disables non-allocate hint of WBNA memory type. 
[48]? Disable early speculative Disables early speculative read access from LS to L2: 
read access from LS to L2 0 
Enables speculative early read access from LS to L2. This is the reset value. 
1 
Disables speculative early read access from LS to L2. 
[47]*" Disable D-side L1/L2 Disables L1 and L2 hardware prefetch across 4KB page boundary even if page is 64KB or 
hardware prefetch across larger: 
4KB page boundary even if 0 
page is 64KB or larger. Enables D-side L1/L2 hardware prefetch across 4KB page boundary if the page is 
64KB or larger. This is the reset value. 
1 
Disables D-sideL1/L2 hardware prefetch across 4KB page boundary even if the page is 
64KB or larger. 
46]*” Disable multiple outstanding Disables multiple outstanding L1 Data TLB misses and L2 TLB hit under miss: 
Pp 
L1 Data TLB misses and L2 
TLB hit under miss j 
Enables multiple outstanding L1 Data TLB misses and L2 TLB hit under miss. This is 
the reset value. 
1 
Disables multiple outstanding L1 Data TLB misses and L2 TLB hit under miss. 
[45]? Disable L1-DCache way Disables L1-DCache way tracker: 


tracker 


0 
Enables L1-DCache way tracker. This is the reset value. 


Disables L1-DCache way tracker. 
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Table 4-77 CPUACTLR_EL1[63:32] bit assignments (continued) 








Bits Name Function 
[44]? Enable data cache cleanas Enables data cache clean as data cache clean and invalidate: 
data cache clean/invalidate 0 
Normal behavior, executes data cache clean as data cache clean. 
This is the reset value. 
1 
Executes data cache clean as data cache clean and invalidate. 
[43]*” Disable VA based hardware Disables the Load/Store hardware prefetcher from using VA to cross page boundaries: 


prefetch 


0 
Enables the Load/Store hardware prefetcher to use VA in generating prefetches that 
can cross page boundaries. This is the reset value. 


Disables the Load/Store hardware prefetcher from using VA in prefetch generation. 




















[42]*” Disable prefetch requests Disables prefetch requests from ReadUnique transactions: 
from ReadUnique 0 
transactions Enables prefetch requests to be generated by ReadUnique transactions. This is the reset 
value. 
1 
Disables prefetch requests to be generated by ReadUnique transactions. 
[41]? Enable snoop hazard while Enables snoop hazard while waiting for second half of atomic exclusive pair: 
waiting for second half of 0 
atomic exe lusiyE pait Disable snoop hazard while waiting for second half of atomic exclusive pair. This is 
the reset value. 
1 
Enable snoop hazard while waiting for second half of the atomic exclusive pair. 
[40] - Reserved, RESO. 
[39]? Disable instruction merging Disables instruction merging: 
0 
Enables instruction merging. This is the reset value. 
1 
Disables instruction merging. 
[38]*” Force FPSCR write flush Forces FPSCR write flush: 
0 
Normal behavior for FPSCR writes. This is the reset value. 
1 
Forces synchronizing flush on all FPSCR writes. 
(37]*’ Disable instruction group Disables instruction group split: 


split 


0 
Enables instruction group split. This is the reset value. 


Disables instruction group split. 
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Table 4-77 CPUACTLR_EL1[63:32] bit assignments (continued) 








Bits Name Function 
[36]? Force implicit DSB on an Forces implicit DSB on ISB event: 
ISB event 0 


Normal behavior. This is the reset value. 


Force implicit DSB on an ISB event. 





[35]? Disable ISB optimization Disables ISB optimization: 











0 
Enables ISB optimization. This is the reset value. 
1 
Disables ISB optimization. 
[34]? Disable Static Branch Disables static branch predictor: 
Predictor 0 
Enables static branch predictor. This is the reset value. 
1 
Disables static branch predictor. 
[33]? Disable main prediction Disables main prediction suppression at target fetch of microBTB: 
suppression at target fetch of 0 
microBTB Enables prediction suppression at target fetch of microBTB. This is the reset value. 
1 
Disables prediction suppression at target fetch of microBTB. 
[32]? Disable L1 Instruction Disables L1 Instruction Cache prefetch: 
Cache prefetch 0 
Enables Instruction Cache prefetch. This is the reset value. 
1 


Disables Instruction Cache prefetch. 





The following figure shows the CPUACTLR_EL1[31:0] bit assignments. 
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31 30 29 28 27 26 25 24 23 22 21 20191817161514131211109 8 76543210 


HIT TVET 








L Enable invalidates of BTB 
Disable Instruction cache 
streaming 
RESO 
Disable micro-BTB 
Disable indirect predictor 
— Execute PLD instructions as a NOP 
RESO 
Execute WFE instructions as a NOP 
Execute WFI instructions as a NOP 
Disable flag renaming optimization 
Force serialization after each group 
—— Limit to one instruction per instruction group 
Force push of SPRs 
Flush after SPR writes 
Force limit of one instruction group commit/deallocate per cycle 
Force in-order issue in branch execute unit 
Enable full Strongly-Ordered & Device loads replay 
Disable L2 TLB performance optimization 
Disable L2 stage 1 translation table walk L2 PA cache 
Disable L2 stage 1 translation table walk cache 
Disable L2 translation table walk IPA PA cache 




































































Disable L2 TLB prefetching 
Force in-order load issue 











Force in-order requests to same set/way 








Non-cacheable streaming enhancement 
Write streaming no-L1-allocate threshold 














Write streaming no-allocate threshold 
Force CX clock enable active 











Force main clock enable active 
Snoop-delayed exclusive handling 





Figure 4-74 CPUACTLR_EL1[31:0] bit assignments 


The following table shows the CPUACTLR_EL1[31:0] bit assignments. 


Table 4-78 CPUACTLR_EL1[31:0] bit assignments 





Bits Name 


Function 





[31] Snoop-delayed exclusive 
handling 


Snoop-delayed exclusive handling. The possible values are: 


0 Normal exclusive handling behavior. This is the reset value. 


1 Modifies exclusive handling behavior by delaying certain snoop requests. 





[30]?™_ Force main clock enable 
active 


Forces main clock enable active. The possible values are: 


0 Does not prevent the clock generator from stopping the processor clock. This is the reset 
value. 


1 Prevents the clock generator from stopping the processor clock. 


If the processor dynamic retention feature is used then this bit must be zero. See Processor 
dynamic retention on page 2-46. 








aw This bit is used internally for debugging and characterization purposes only. For normal operation, ARM recommends that you do not change the value of this bit 


from its reset value. 
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Table 4-78 CPUACTLR_EL1[31:0] bit assignments (continued) 


























Bits Name Function 
[29]? Force Advanced SIMD Forces Advanced SIMD and Floating-point clock enable active. The possible values are: 
and floating-p otoncloge 0 Does not prevent the clock generator from stopping the Advanced SIMD and Floating-point 
enable active pi 
clock. This is the reset value. 
1 Prevents the clock generator from stopping the Advanced SIMD and Floating-point clock. 
See Advanced SIMD and FP clock gating on page 2-49. 
If the processor dynamic retention feature is used then this bit must be zero. See Processor 
dynamic retention on page 2-46. 
[28:27] Write streaming no- Write streaming no-allocate threshold. The possible values are: 
allocate threshold @bee@ 12" consecutive streaming cache line does not allocate in the L1 or L2 cache. This is the 
reset value. 
@b@1 128* consecutive streaming cache line does not allocate in the L1 or L2 cache. 
@b1@ 512" consecutive streaming cache line does not allocate in the L1 or L2 cache. 
@b11 Disables streaming. All Write-Allocate lines allocate in the L1 or L2 cache. 
[26:25] Write streaming no-L1- Write streaming no-L1-allocate threshold. The possible values are: 
allocate tapes Ot @bee 4" consecutive streaming cache line does not allocate in the L1 cache. This is the reset 
value. 
@be1 64" consecutive streaming cache line does not allocate in the L1 cache. 
@b1@ 128™ consecutive streaming cache line does not allocate in the L1 cache. 
@b11 Disables streaming. All Write-Allocate lines allocate in the L1 cache. 
[24] Non-cacheable streaming Non-cacheable streaming enhancement. You can set this bit only if your memory system meets 
enhancement the requirement that cache line fill requests from the Cortex-A72 processor are atomic. The 
possible values are: 
0 Disables higher performance Non-cacheable load forwarding. This is the reset value. 
1 Enables higher performance Non-cacheable load forwarding. See 6.4.4 Non-cacheable 
streaming enhancement on page 6-292 for more information. 
[23]*” Force in-order requests to Forces in-order requests to the same set and way. The possible values are: 
the same setand way 0 Does not force in-order requests to the same set and way. This is the reset value. 
1 Forces in-order requests to the same set and way. 
(22]*“ Force in-order load issue Forces in-order load issue. The possible values are: 
0 Does not force in-order load issue. This is the reset value. 
1 Forces in-order load issue. 
[21]? Disable L2 TLB Disables L2 TLB prefetching. The possible values are: 
prefetching 0 Enables L2 TLB prefetching. This is the reset value. 
1 Disables L2 TLB prefetching. 
[20]? Disable L2 translation Disables L2 translation table walk Immediate Physical Address (IPA) to Physical Address (PA) 


table walk IPA PA cache 


cache. The possible values are: 


0 Enables L2 translation table walk IPA to PA cache. This is the reset value. 
1 Disables L2 translation table walk IPA to PA cache. 
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Table 4-78 CPUACTLR_EL1[31:0] bit assignments (continued) 



































Bits Name Function 
19]*’ Disable L2 stage 1 Disables L2 stage 1 translation table walk cache. The possible values are: 
g 
n table walk 0 Enables L2 stage 1 translation table walk cache. This is the reset value. 
cache 
1 Disables L2 stage 1 translation table walk cache. 
18]*“ Disable L2 stage 1 Disables L2 stage 1 translation table walk L2 PA cache. The possible values are: 
8 
aie mile well? 0 Enables L2 stage 1 translation table walk L2 PA cache. This is the reset value. 
cache 
1 Disables L2 stage 1 translation table walk L2 PA cache. 

[17]}*’ Disable L2 TLB Disables L2 TLB performance optimization. The possible values are 

performance optimization 0 Enables L2 TLB optimization. This is the reset value. 
1 Disables L2 TLB optimization. 

[16]? Enable full Strongly- Enables full Strongly-ordered or Device load replay. The possible values are: 
o and Device load 0 Disables full Strongly-ordered or Device load replay. This is the reset value. 
replay ; 

1 Enables full Strongly-ordered or Device load replay. 

[15]? Force in-order issue in Forces in-order issue in branch execute unit. The possible values are: 

branch execute urit 0 Disables forced in-order issue. This is the reset value. 
1 Forces in-order issue. 

[14]? Force limit of one Forces limit of one instruction group to commit and de-allocate per cycle. The possible values 
instruction group are: 
ee per 0 Normal commit and de-allocate behavior. This is the reset value. 
cycle ‘ . 

1 Limits commit and de-allocate to one instruction group per cycle. 

[13]? Flush after Special Flushes after certain SPR writes. The possible values are: 

a Register (SPR) 0 Normal behavior for SPR writes. This is the reset value. 
writes 
1 Flushes after certain SPR writes. 
12]*” Force push of SPRs Forces push of certain SPRs from local dispatch copies to shadow copies. The possible values 
pP 
are: 
0 Normal behavior for SPRs. This is the reset value. 
1 Pushes certain SPRs from local dispatch copies to shadow copies. 
Note 
Setting this bit to 1 forces the processor to behave as if bit[13] is set to 1. 
[11]*” Limit to one instruction Limits to one instruction per instruction group. The possible values are: 


per instruction group 


0 Normal instruction grouping. This is the reset value. 


1 Limits to one instruction per instruction group. 
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Table 4-78 CPUACTLR_EL1[31:0] bit assignments (continued) 





Bits 


Name 


[10]*” Force serialization after 


each instruction group 


Function 


Forces serialization after each instruction group. The possible values are: 


0 Disables forced serialization after each instruction group. This is the reset value. 


1 Forces serialization after each instruction group. 





Note 
Setting this bit to 1 forces the processor to behave as if bit[11] is set to 1. 








[9]*” 


Disable flag renaming 
optimization 


Disables flag renaming optimization. The possible values are: 


0 Enables normal flag renaming optimization. This is the reset value. 


1 Disables normal flag renaming optimization. 





(8]°” 


Execute WFI instruction 
as a NOP instruction 


Executes WFI instruction as a NOP instruction. The possible values are: 
0 Executes WFI instruction as defined in the ARM” Architecture Reference Manual ARMv8. 
This is the reset value. 


1 Executes WFI instruction as a NOP instruction, and does not put the processor in WFI low- 
power state. 





Kias 


Execute WFE instruction 
as a NOP instruction 


Executes WFE instruction as a NOP instruction. The possible values are: 
0 Executes WFE instruction as defined in the ARM” Architecture Reference Manual ARMS. 
This is the reset value. 


1 Executes WFE instruction as a NOP instruction, and does not put the processor in WFE low- 
power state. 





[6] 


Reserved, RESO. 





[5] 


Execute PLD and PLDW 
instructions as a NOP 


Executes PLD and PLDW instructions as a NOP instruction. The possible values are: 


0 Executes PLD and PLDW instructions as defined in the ARM® Architecture Reference Manual 
ARMv8. This is the reset value. 


1 Executes PLD and PLDw instructions as a NOP instruction. 





[4] 


Disable indirect predictor 


Disables indirect predictor. The possible values are: 


0 Enables indirect predictor. This is the reset value. 


1 Disables indirect predictor. 





Bi" 


Disable micro-BTB 


Disables micro-Branch Target Buffer (BTB). The possible values are: 


0 Enables micro-BTB. This is the reset value. 


1 Disables micro-BTB. 





[2] 


Reserved, RESO. 
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Table 4-78 CPUACTLR_EL1[31:0] bit assignments (continued) 





Bits Name Function 





[1]? Disable Instruction Cache Disables Instruction Cache miss streaming. The possible values are: 


mSS sireaming 0 Enables Instruction Cache miss streaming. Sequential fetches resulting from Instruction 


Cache misses wait until individual packets arrive. This is the reset value. 


1 Disables Instruction Cache miss streaming. Sequential fetches resulting from Instruction 
Cache misses internally generate misses for each packet. 





[0]? Enable invalidates of Enables invalidate of BTB. The possible values are: 


BIB 0 The Invalidate Instruction Cache All and Invalidate Instruction Cache by VA instructions 


only invalidates the instruction cache array. This is the reset value. 


1 The Invalidate Instruction Cache All and Invalidate Instruction Cache by VA instructions 
invalidates the instruction cache array and branch target buffer. 





To access the CPUACTLR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, S3_1_c15_c2_0; Read EL1 CPU Auxiliary Control Register 
MSR S3_1_c15_c2_0, <Xt>; Write EL1 CPU Auxiliary Control Register 


To access the CPUACTLR in AArch32 state, read or write the CP15 register with: 


MRRC p15, ©, <Rt>, <Rt2>, c15; Read CPU Auxiliary Control Register 
MCRR p15, ©, <Rt>, <Rt2>, c15; Write CPU Auxiliary Control Register 


4.3.67 CPU Extended Control Register, EL1 
The CPUECTLR_ ELI characteristics are: 


Purpose 


Provides additional IMPLEMENTATION DEFINED configuration and control options for the processor. 
Usage constraints 


The accessibility to the CPUECTLR_EL1 by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RW°* RW** RWY RW RW 





The CPUECTLR_ELI! can be written dynamically. 


Configurations 
The CPUECTLR ELl! is: 


e Common to the Secure and Non-secure states. 
e A 64-bit read/write register. 
e Architecturally mapped to the AArch32 CPUECTLR register. 
Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 


The following figure shows the CPUECTLR_EL!1 bit assignments. 





ax Write access if ACTLR_EL3.CPUECTLR is 1 and ACTLR_EL2.CPUECTLR is 1, or ACTLR_EL3.CPUECTLR is 1 and SCR.NS is 0. 


ay Write access if ACTLR_EL3.CPUECTLR is 1. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 4-206 
Non-Confidential 


4 System Control 
4.3 AArch64 register descriptions 


39 38 37 36 35 34 33 32 31 765 3 2 0 
Disable table walk descriptor access prefetch- SMPEN— | 
RESO Processor dynamic retention control 


L2 instruction fetch prefetch distance 
RESO 
L2 load/store data prefetch distance 


Figure 4-75 CPUECTLR_EL1 bit assignments 
The following table shows the CPUECTLR_EL] bit assignments. 


Table 4-79 CPUECTLR_EL1 bit assignments 














Bits Name Function 
[63:39] - Reserved, RESO. 
[38] Disable table Disables table walk descriptor access prefetch. The possible values are: 

walk descriptor 0 

access prefetch Enables table walk descriptor access prefetch. This is the reset value. 

1 
Disables table walk descriptor access prefetch. 

[37] - Reserved, RESO. 





[36:35] L2 instruction Indicates the L2 instruction fetch prefetch distance. It is the number of requests by which the prefetcher is 

















fetch prefetch ahead of the demand request stream. It also specifies the maximum number of prefetch requests generated 
distance on a demand miss. The possible values are: 
ebee 
0 requests, disables instruction prefetch. 
@be1 
1 request. 
@b10 
2 requests. 
@b11 
3 requests. This is the reset value. 
[34] - Reserved, RESO. 
[33:32] L2 load data Indicates the L2 load data prefetch distance. It is the number of requests by which the prefetch request to 
prefetch distance the L2, on a load stream, is ahead of the demand request stream. The possible values are: 
@bee 
16 requests. 
@be1 
18 requests. 
0b10 
20 requests. 
0b11 
22 requests. This is the reset value. 
[81:7] - Reserved, RESO. 
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Table 4-79 CPUECTLR_EL1 bit assignments (continued) 





Bits Name Function 





[6] SMPEN Enables the processor to receive instruction cache and TLB maintenance operations broadcast from other 
processors in the cluster. 


You must set this bit before enabling the caches and MMU, or performing any cache and TLB 
maintenance operations. 


You must clear this bit during a processor power down sequence. See 2.4 Power management 
on page 2-42. 


The possible values are: 


0 
Disables receiving of instruction cache and TLB maintenance operations. This is the reset value. 


Enables receiving of instruction cache and TLB maintenance operations. 





Note 


e Any processor instruction cache and TLB maintenance operations can execute the request, regardless 
of the value of the SMPEN bit. 

e This bit has no impact on data cache maintenance operations. 

¢ Inthe Cortex-A72 processor, the L1 data cache and L2 cache are always coherent, for shared or non- 
shared data, regardless of the value of the SMPEN bit. 











[5:3] - Reserved, RESO. 
[2:0] Processor Processor dynamic retention control. The possible values are: 
dynamic abeee 


tenti trol : : : zos 
ee eee Processor dynamic retention disabled. This is the reset value. 


@bee1 

2 Generic Timer ticks required before retention entry. 
b010 

8 Generic Timer ticks required before retention entry. 
b011 

32 Generic Timer ticks required before retention entry. 
b100 

64 Generic Timer ticks required before retention entry. 
@b101 

128 Generic Timer ticks required before retention entry. 
@b1190 

256 Generic Timer ticks required before retention entry. 
@b111 


512 Generic Timer ticks required before retention entry. 


All other values are reserved. 





To access the CPUECTLR_ELI in AArch64 state, read or write the register with: 


MRS <Xt>, S3_1_c15_c2_1; Read EL1 CPU Extended Control Register 
MSR S3_1_c15_c2_1, <Xt>; Write EL1 CPU Extended Control Register 


To access the CPUECTLR in AArch32 state, read or write the CP15 register with: 


MRRC p15, 1, <Rt>, <Rt2>, c15; Read CPU Extended Control Register 
MCRR p15, 1, <Rt>, <Rt2>, c15; Write CPU Extended Control Register 
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4.3.68 CPU Memory Error Syndrome Register, EL1 
The CPUMERRSR_ ELI characteristics are: 
Purpose 
Holds the number of memory errors that have occurred in the following L1 and L2 RAMs: 
« LI1-I Tag RAM. 
e LI-I Data RAM. 
« LI-D Tag RAM. 
e LI-D Data RAM. 
e L2 TLB RAM. 
A write of any value to the register updates the register to zero. 
Usage constraints 
The accessibility to the CPUMERRSR_ ELI by Exception level is: 
ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 
- RW RW RW RW RW 
Configurations 
The CPUMERRSR_ ELl! is: 
e Common to the Secure and Non-secure states. 
e A 64-bit read/write register. 
e Architecturally mapped to the AArch32 CPUMERRSR register. 
Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 
The following figure shows the CPUMERRSR_ELI bit assignments. 
63 62 48 47 40 39 32 31 30 24 23 22 18 17 0 
Reserved | Other error [Repeat error | RAMID seca Index 
count count 
L Fatal e Valid L Reserved 
Figure 4-76 CPUMERRSR_EL1 bit assignments 
The following table shows the CPUMERRSR_ ELI bit assignments. 
Table 4-80 CPUMERRSR_EL1 bit assignments 
Bits Function 
[63] Fatal bit. This bit is set to 1 on the first memory error that caused a Data Abort. It is a sticky bit so that after 
it is set, it remains set until the register is written. The reset value is 0. 
[62:48] Reserved, RESO. 
[47:40] Other error This field is set to 0 on the first memory error and is incremented on any memory error that does not match 
the RAMID, bank, way, or index information in this register while the sticky Valid bit is set. The reset value 
is 0. 
[39:32] Repeat error This field is set to 0 on the first memory error and is incremented on any memory error that exactly matches 
the RAMID, bank, way or index information in this register while the sticky Valid bit is set. The reset value 
is 0. 
[31] Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it remains set 
until the register is written. The reset value is 0. 
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Table 4-80 CPUMERRSR_EL1 bit assignments (continued) 




















Bits Name Function 
[30:24] RAMID RAM Identifier. Indicates the RAM, the first memory error occurred in. The possible values are: 
0x00 L1-I Tag RAM. 
0x01 L1-I Data RAM. 
0x08 L1-D Tag RAM. 
0x09 L1-D Data RAM. 
0x18 L2 TLB RAM. 
[23] - Reserved, RESO. 
[22:18] Bank/Way Indicates the bank or way of the RAM where the first memory error occurred. 
[17:0] Index Indicates the index address of the first memory error. 
Note 





¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 

¢ If two or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily, while the Other error count field is only incremented by one. 

e Iftwo or more memory error events from different RAMs, that do not match the RAMID, bank, way, 
or index information in this register while the sticky Valid bit is set, occur in the same cycle, the 
Other error count field is only incremented by one. 





To access the CPUMERRSR_ EL] in AArché6é4 state, read or write the register with: 


MRS <Xt>, S3_1_c15_c2_2 ; Read EL1 CPU Memory Error Syndrome Register 
MSR S3_1_c15_c2_2 , <Xt>; Write EL1 CPU Memory Error Syndrome Register 


To access the CPUMERRSR in AArch32 state, read or write the CP15 register with: 


MRRC p15, 2, <Rt>, <Rt2>, c15; Read CPU Memory Error Syndrome Register 
MCRR p15, 2, <Rt>, <Rt2>, c15; Write CPU Memory Error Syndrome Register 


4.3.69 L2 Memory Error Syndrome Register, EL1 
The L2MERRSR_ELI characteristics are: 


Purpose 


Usage 
constraints 


Configurations 


Holds the number of memory errors that have occurred in the following L2 RAMs: 
e L2 Tag RAM. 

e L2 Data RAM. 

e L2 Snoop Tag RAM. 

e L2 Dirty RAM. 

e L2 Inclusion PLRU RAM. 


A write of any value to the register updates the register to zero. 


The accessibility to the LAMERRSR_ELI by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





The LZ2ZMERRSR_ ELI is: 

e Common to the Secure and Non-secure states. 

e A 64-bit read/write register. 

e Architecturally mapped to the AArch32 LZMERRSR register. 
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Attributes See the register summary in Table 4-15 AArch64 implementation defined registers 
on page 4-86. 


The following figure shows the LAMERRSR_ELI bit assignments. 











63 62 48 47 40 39 32 31 30 24 23 22 21 18 17 0 
| RESO Other error |Repeat error RAMID soem index 
count count 





L Fatal L valid 


Figure 4-77 L2MERRSR_EL1 bit assignments 
The following table shows the L2MERRSR_ELI bit assignments. 


Table 4-81 L2MERRSR_EL1 bit assignments 


Bits Name Function 





[63] Fatal Fatal bit. This bit is set to 1 on the first memory error that caused a Data Abort. It is a sticky bit so that after it 
is set, it remains set until the register is written. The reset value is 0. 














[62:48] - Reserved, RESO. 
[47:40] Other error This field is set to 0 on the first memory error and is incremented on any memory error that does not match 
count the RAMID, bank, way, or index information in this register while the sticky Valid bit is set. The reset value is 
0. 
[39:32] Repeat error This field is set to 0 on the first memory error and is incremented on any memory error that exactly matches 
count the RAMID, bank, way or index information in this register while the sticky Valid bit is set. The reset value is 
0. 
[31] Valid Valid bit. This bit is set to 1 on the first memory error. It is a sticky bit so that after it is set, it remains set until 


the register is written. The reset value is 0. 














[30:24] RAMID RAM Identifier. Indicates the RAM where the first memory error occurred. The possible values are: 
0b001 0000 L2 Tag RAM. 
0b001 0001 L2 Data RAM. 
0b001 0010 L2 Snoop Tag RAM. 
0b001 0100 L2 Dirty RAM. 
0b0011000 L2 Inclusion PLRU RAM. 

[23:22] - Reserved, RESO. 
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Table 4-81 L2MERRSR_EL1 bit assignments (continued) 





Bits Name Function 





[21:18] CPUID/Way Indicates which processor and way of the RAM where the first memory error occurred. 
For L2 Tag, Data, and Dirty RAMs, bits[21:18] indicate one of 16 ways, from way 0 to way 15. 


For L2 Snoop Tag RAM: 
¢ Bits[20:19] indicate which processor of the L1 Tag RAM. 
¢ Bit[18] indicates which way of the Tag RAM. 


The possible values are: 














ebeeee CPU0 tag, way 0. 
@be001 CPU0 tag, way 1. 
0b0010 CPU1 tag, way 0. 
@bee11 CPU1 tag, way 1. 
0be100 CPU2 tag, way 0. 
@be101 CPU2 tag, way 1. 
0b0110 CPU3 tag, way 0. 
0b0111 CPU3 tag, way 1. 
[17:0] Index Indicates the index address of the first memory error. 
Note 


¢ Iftwo or more memory errors in the same RAM occur in the same cycle, only one error is reported. 

¢ If two or more first memory error events from different RAMs occur in the same cycle, one of the 
errors is selected arbitrarily, while the Other error count field is only incremented by one. 

¢ Iftwo or more memory error events from different RAMs, that do not match the RAMID, bank, way, 
or index information in this register while the sticky Valid bit is set, occur in the same cycle, the 
Other error count field is only incremented by one. 


To access the LIMERRSR_ELI in AArch64 state, read or write the register with: 


MRS <Xt>, S3_1_c15_c2_3 ; Read EL1 L2 Memory Error Syndrome Register 
MSR S3_1_c15_c2_3, <Xt> ; Write EL1 L2 Memory Error Syndrome Register 


To access the LAMERRSR in AArch32 state, read or write the CP15 register with: 


MRRC p15, 3, <Rt>, <Rt2>, c15; Read L2 Memory Error Syndrome Register 
MCRR p15, 3, <Rt>, <Rt2>, c15; Write L2 Memory Error Syndrome Register 


4.3.70 Configuration Base Address Register, EL1 


The CBAR_ELI characteristics are: 


Purpose 

Holds the physical base address of the memory-mapped GIC CPU interface registers. 
Usage constraints 

The accessibility to the CBAR_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 
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Configurations 
The CBAR _ ELl! is: 
¢ Common to the Secure and Non-secure states. 
e A 64-bit register in AArch64 state. 


Attributes 
See the register summary in Table 4-15 AArch64 implementation defined registers 


on page 4-86. 
The following figure shows the CBAR_ELI bit assignments. 


63 44 43 18 17 







RESO PERIPHBASE 


Figure 4-78 CBAR_EL1 bit assignments 


The following table shows the CBAR_EL]1 bit assignments. 
Table 4-82 CBAR_EL1 bit assignments 





Bits Name Function 





[63:44] - Reserved, RESO 





[43:18] PERIPHBASE The primary input PERIPHBASE[43:18] determines the reset value 





[17:0] - Reserved, RESO 





To access the CBAR_EL1! in AArch64 state, read the register with: 


MRS <Xt>, s3_1_c15_c3_@; Read EL1 Configuration Base Address Register 
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4.4 AArch32 register summary 
This section gives a summary of the System registers in AArch32 state. 


The System registers are a set of registers that you can write to and read from. Some of the registers 
permit more than one type of operation. 


The registers are accessed by the MCR and MRC instructions for 32-bit registers and the MCRR and MRRC 
instructions for 64-bit registers. The following sections describe the System registers grouped by CRn in 
the order of op1, CRm, and op?2: 


e 4.4.1 c0 registers on page 4-215. 

e 4.4.2 cl registers on page 4-216. 

* 4.4.3 c2 registers on page 4-217. 

e 4.4.4 c3 registers on page 4-218. 

e 4.4.5 c5 registers on page 4-218. 

* 4.4.6 có registers on page 4-218. 

e 4.4.7 c7 register on page 4-219. 

* 4.4.8 c7 System operations on page 4-219. 
* 4.4.9 c8 System operations on page 4-220. 
* 4.4.10 c9 registers on page 4-221. 

e 4.4.11 c10 registers on page 4-222. 

e 4.4.12 c12 registers on page 4-222. 

e 4.4.13 c13 registers on page 4-222. 

* 4.4.14 cl4 registers on page 4-223. 

e 4.4.15 cl5 registers on page 4-224. 


The following subsection describes the 64-bit registers and provides cross-references to individual 
register descriptions: 


e 4.4.16 64-bit registers on page 4-224. 


In addition to listing the System registers by CRn ordering, the following subsections describe the 
System registers by functional group: 

e 4.4.17 Identification registers on page 4-225. 

e 4.4.18 CPUID registers on page 4-227. 

e 4.4.19 Virtual memory control registers on page 4-228. 

e 4.4.20 Fault and Exception handling registers on page 4-229. 
e 4.4.21 Other System registers on page 4-230. 

e 4.4.22 Cache maintenance operations on page 4-231. 

© 4.4.23 TLB maintenance operations on page 4-231. 

¢ 4.4.24 Address translation operations on page 4-232. 

e 4.4.25 Miscellaneous operations on page 4-233. 

¢ 4.4.26 Performance Monitors registers on page 4-233. 

e 4.4.27 Security registers on page 4-234. 

e 4.4.28 Virtualization registers on page 4-234. 

¢ 4.4.29 Hyp mode TLB maintenance operations on page 4-236. 
¢ 4.4.30 Generic Timer registers on page 4-236. 

¢ 4.4.31 Implementation defined registers on page 4-236. 


The following table describes the column headings that the System register summary tables use 
throughout AArch32 state. These correspond to fields within the MCR and MRC instruction mnemonics: 


MCR p15, op1, Rt, CRn, CRm, op2 
MRC p15, op1, Rt, CRn, CRm, op2 
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Table 4-83 Column headings definition for System register summary tables 





Column name Description 


























CRn Register number within the System registers 
opl Opcode_1 value for the register 
CRm Operational register number within CRn 
op2 Opcode_2 value for the register 
Name Short form architectural, operation, or code name for the register 
Type One of: 

e Read-only (RO). 

e  Write-only (WO). 

e Read/write (RW). 
Reset Reset value of register 
Description Cross-reference to register description 





The following table shows the CP15 System registers when CRn is c0 and the processor is in AArch32 


state. 


Table 4-84 c0 register summary 



































opi CRm op2 Name Type Reset Description 
0 c0 0 MIDR RO 0@x41@FD@83 Main ID Register. See 4.3.1 Main ID Register, EL] on page 4-89. 
1 CTR RO 0x8444C@04 Cache Type Register. See 4.3.26 Cache Type Register, ELO on page 4-121. 
2 TCMTR - 0x00000000 4.5.1 TCM Type Register on page 4-239. 
3 TLBTR RO 0x@0000008 4.5.2 TLB Type Register on page 4-239. 
4,7 MIDR RO 0©x41@FD@83 Aliases of Main ID Register, see 4.3.7 Main ID Register, EL] on page 4-89. 
5 MPIDR RO 0x80000003° 4.5.3 Multiprocessor Affinity Register on page 4-240. 
6 REVIDR RO 0x00000008 Revision ID Register. See 4.3.3 Revision ID Register, EL] on page 4-92. 
cl 0 ID_PFRO RO 0x00000131 Processor Feature Register 0. See 4.3.4 AArch32 Processor Feature 
Register 0, ELI on page 4-93. 
1 ID_PFRI RO @x@@@11011"* Processor Feature Register 1. See 4.3.5 AArch32 Processor Feature 
Register 1, ELI on page 4-94. 
2 ID_DFRO RO  0x@3010066 Debug Feature Register 0. See 4.3.6 AArch32 Debug Feature Register 0, 
ELI on page 4-95. 
3 ID_AFRO RO 0x0000000O Auxiliary Feature Register 0. See 4.3.7 AArch32 Auxiliary Feature Register 


0, ELI on page 4-96. 





4 ID_MMFRO RO 


0x10201105 


Memory Model Feature Register 0. See 4.3.8 AArch32 Memory Model 
Feature Register 0, ELI on page 4-96. 








aZ The reset value depends on the primary inputs, CLUSTERIDAFF1 and CLUSTERIDAFF2, and the number of cores that the device implements. The value shown 
is for a four processor implementation, with CLUSTERIDAFF1 and CLUSTERIDAFF2 set to zero. 
ba The reset value depends on the primary input GICCDISABLE. The value shown assumes the GICCDISABLE signal is tied HIGH. 
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Table 4-84 c0 register summary (continued) 





















































op1 CRm op2 Name Type Reset Description 
> ID_MMFRI RO 0x40000000 Memory Model Feature Register 1. See 4.3.9 AArch32 Memory Model 
Feature Register 1, ELI on page 4-98. 
6 ID_MMFR2 RO 0x@12600@@ Memory Model Feature Register 2. See 4.3.10 AArch32 Memory Model 
Feature Register 2, ELI on page 4-99. 
7 ID_MMFR3 RO  @x@2102211 Memory Model Feature Register 3. See 4.3.17 AArch32 Memory Model 
Feature Register 3, ELI on page 4-101. 
c2 0 ID_ISARO RO 0x02101110 Instruction Set Attribute Register 0. See 4.3.12 AArch32 Instruction Set 
Attribute Register 0, ELI on page 4-103. 
1 IDISARI RO — 0x13112111 [Instruction Set Attribute Register 1. See 4.3.13 AArch32 Instruction Set 
Attribute Register 1, EL1 on page 4-104. 
2 ID_ISAR2 RO 0x21232042 Instruction Set Attribute Register 2. See 4.3.14 AArch32 Instruction Set 
Attribute Register 2, EL] on page 4-106. 
3 ID_ISAR3 RO 0x@1112131 Instruction Set Attribute Register 3. See 4.3.15 AArch32 Instruction Set 
Attribute Register 3, EL1 on page 4-107. 
4 ID_ISAR4 RO 0x@@011142 Instruction Set Attribute Register 4. See 4.3.16 AArch32 Instruction Set 
Attribute Register 4, EL] on page 4-108. 
5 ID ISARS RO  @x@9010001"> Instruction Set Attribute Register 5. See 4.3.17 AArch32 Instruction Set 
Attribute Register 5, EL1 on page 4-110. 
1 c0 0 CCSIDR RO UNK Cache Size ID Register. See 4.3.22 Cache Size ID Register, EL1 
on page 4-117. 
1 CLIDR RO 0x0A200023 Cache Level ID Register. See 4.3.23 Cache Level ID Register, EL1 
on page 4-118. 
7 AIDR - 0x00000000 Auxiliary ID Register. See 4.3.24 Auxiliary ID Register, EL] on page 4-120. 
2 c0 0 CSSELR RW UNK Cache Size Selection Register. See 4.3.25 Cache Size Selection Register, 
ELI on page 4-120. 
4 c0 0 VPIDR RW -be Virtualization Processor ID Register. See 4.3.28 Virtualization Processor ID 
Register, EL2 on page 4-123. 
5 VMPIDR RO -bd Virtualization Multiprocessor ID Register. See 4.5.4 Virtualization 
Multiprocessor ID Register on page 4-241. 
4.4.2 c1 registers 





The following table shows the System registers when CRn is cl and the processor is in AArch32 state. 


The reset value is 0x00011121 if the Cryptography engine is implemented. 
The reset value is the value of the Main ID Register. 
The reset value is the value of the Multiprocessor Affinity Register. 
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Table 4-85 c1 register summary 






















































































op1 CRm op2 Name Type Reset Description 
0 c0 0 SCTLR RW _  @x@0C50838"° 4.5.5 System Control Register on page 4-242. 
1 ACTLR - 0x00000000 Auxiliary Control Register. See 4.3.39 Auxiliary Control Register, EL3 
on page 4-143. 
2 CPACR RW _  0x0@0000080 4.5.6 Architectural Feature Access Control Register on page 4-247. 
cl 0 SCR RW 0x@e@e000008 4.5.7 Secure Configuration Register on page 4-248. 
1 SDER RW 0Xx0000O0O0O Secure Debug Enable Register. 
2 NSACR RW! @x@@@@8808 4.5.8 Non-secure Access Control Register on page 4-251. 
c3 1 SDCR RW 0xe@@000000 8 4.5.9 Secure Debug Configuration Register on page 4-252. 
4 c0 0  HSCTLR RW 0x30C50838 Hyp System Control Register. "f 
1 HACTLR RW ~ 0x00000000 Hyp Auxiliary Control Register. See 4.3.33 Auxiliary Control Register, EL2 
on page 4-130. 
cl 0 HCR RW 0xe@ee00008 4.5.10 Hyp Configuration Register on page 4-254. 
1 HDCR RW _~ exeeeeeees?" 4.5.12 Hyp Debug Control Register on page 4-261. 
2 HCPTR RW 0x000033FF = 4.5.13 Hyp Architectural Feature Trap Register on page 4-263. 
3 HSTR RW 0x@@000008 Hyp System Trap Register. See 4.3.36 Hypervisor System Trap Register 
on page 4-139. 
4 HCR2 RW 0x00000000 4.5.11 Hyp Configuration Register 2 on page 4-259. 
T HACR RW = 0x0@0000008 4.3.37 Hyp Auxiliary Configuration Register on page 4-141. 
4.4.3 c2 registers 
The following table shows the System registers when CRn is c2 and the processor is in AArch32 state. 
Table 4-86 c2 register summary 
op1 CRm op2 Name Type Reset Description 
0 c0 0 TTBRO RW UNK 
4.5.14 Translation Table Base Register 0 and Register 1 on page 4-265 
1 TTBRI RW UNK 
2 TTBCR RW @x00000000i 4.5.15 Translation Table Base Control Register on page 4-265 
4 c0 2 HTCR RW UNK 4.5.16 Hyp Translation Control Register on page 4-266 
cl 2 VTCR RW UNK Virtualization Translation Control Register, see the ARM® Architecture Reference 
Manual ARMv8 
be The reset value depends on primary input, CFGEND. The value shown assumes this signal is set to zero. 
bf See the ARM® Architecture Reference Manual ARMvV8 for more information. 
bg RO at EL2 and ELO(NS). 
x The reset value for bit[7] is UNK. 
1 


The reset value is 2x@@000000 for the Secure copy of the register. The reset value for the EAE bit of the Non-secure copy of the register is @b@. You must program 
the Non-secure copy of the register with the required initial value, as part of the processor boot sequence. 





ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 


4-217 
Non-Confidential 


4 System Control 
4.4 AArch32 register summary 


4.4.4 c3 registers 


The following table shows the System registers when CRn is c3 and the processor is in AArch32 state. 


Table 4-87 c3 register summary 





op1 CRm op2 Name Type Reset Description 





0 c0 0 DACR RW UNK Domain Access Control Register, see the ARM” Architecture Reference Manual ARMv8 





4.4.5 c5 registers 


The following table shows the System registers when CRn is c5 and the processor is in AArch32 state. 


Table 4-88 c5 register summary 











opi CRm op2 Name Type Reset Description 
0 c0 0 DFSR RW UNK 4.5.17 Data Fault Status Register on page 4-267. 
1 IFSR RW UNK Instruction Fault Status Register. See 4.3.51 Instruction Fault Status Register, 


EL2 on page 4-159. 





cl 0 ADFSR RW 0x00000000 Auxiliary Data Fault Status Register. See 4.3.48 Auxiliary Fault Status Register 
0, ELI and EL3 on page 4-156. 





1 AIFSR RW _  0x@@000080 Auxiliary Instruction Fault Status Register. See 4.3.49 Auxiliary Fault Status 
Register 1, ELI and EL3 on page 4-157. 





4 cl 0 HADFSR RW  0x@@000800 Hyp Auxiliary Data Fault Status Register. See 4.3.52 Auxiliary Fault Status 
Register 0, EL2 and Hyp Auxiliary Data Fault Status Register on page 4-163. 





1 HAIFSR RW  0x00000000 Hyp Auxiliary Instruction Fault Status Register. See 4.3.53 Auxiliary Fault 
Status Register 1, EL2 and Hyp Auxiliary Instruction Fault Status Register 
on page 4-163. 





c2 0 HSR RW UNK Hyp Syndrome Register. See 4.3.54 Exception Syndrome Register, EL2 
on page 4-163. 





4.4.6 c6 registers 


The following table shows the System registers when CRn is c6 and the processor is in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information about these registers. 


Table 4-89 c6 register summary 





op1 CRm op2 Name_ Type Reset Description 
































0 c0 0 DFAR RW UNK Data Fault Address Register 
2 IFAR RW UNK Instruction Fault Address Register 
4 c0 0 HDFAR RW UNK Hyp Data Fault Address Register 
2 HIFAR RW UNK Hyp Instruction Fault Address Register 
4 HPFAR RW UNK Hyp IPA Fault Address Register 
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4.4.7 c7 register 
The following table shows the System registers when CRn is c7 and the processor is in AArch32 state. 
Table 4-90 c7 register summary 
op1 CRm op2 Name Type Reset Description 
0 c4 0 PAR RW UNK 4.5.18 Physical Address Register on page 4-271 
4.4.8 c7 System operations 
The following table shows the System operations when CRn is c7 and the processor is in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information about these operations. 
Table 4-91 c7 System operation summary 
opi CRm op2 Name Description 
0 cl 0 ICIALLUIS — Invalidate all instruction caches Inner Shareable to PoU® 
6 BPIALLIS Invalidate all entries from branch predictors Inner Shareable 
c5 0 ICIALLU Invalidate all Instruction Caches to PoU 
1 ICIMVAU Invalidate Instruction Caches by VA to PoU 
4 CP15ISB Instruction Synchronization Barrier operation, this operation is deprecated in ARMv8-A 
6 BPIALL Invalidate all entries from branch predictors 
7 BPIMVA Invalidate VA from branch predictors 
c6 1 DCIMVAC Invalidate data cache line by VA to PoC?! 
2 DCISW Invalidate data cache line by set/way 
c8 0 ATS1CPR Stage 1 current state PL1 read 
1 ATS1CPW Stage 1 current state PL1 write 
2 ATS1CUR Stage 1 current state unprivileged read 
3 ATS1CUW Stage 1 current state unprivileged write 
4 ATS12NSOPR Stages 1 and 2 Non-secure only PL1 read 
5 ATS12NSOPW Stages 1 and 2 Non-secure only PL1 write 
6 ATS12NSOUR Stages | and 2 Non-secure only unprivileged read 
7 ATS12NSOUW Stages 1 and 2 Non-secure only unprivileged write 
cl0 1 DCCMVAC Clean data cache line by VA to PoC 
2 DCCSW Clean data cache line by set/way 
4 CP15DSB Data Synchronization Barrier operation, this operation is deprecated in ARMv8-A 
5 CP15DMB Data Memory Barrier operation, this operation is deprecated in ARMv8-A 
cll 1 DCCMVAU Clean data cache line by VA to PoU 
bj PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 data cache or outside of the processor, in which case PoU is 
dependent on the external memory system. 
bk PoC = Point of Coherence. The PoC is always outside of the processor and is dependent on the external memory system. 
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Table 4-91 c7 System operation summary (continued) 























opi CRm op2 Name Description 
cl4 1 DCCIMVAC Clean and invalidate data cache line by VA to PoC 
2 DCCISW Clean and invalidate data cache line by set/way 
4 c8 0 ATS1HR Stage 1 Hyp mode read 
1 ATS1HW Stage 1 Hyp mode write 





4.4.9 


c8 System operations 


The following table shows the System operations when CRn is c8 and the processor is in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information about these operations. 


Table 4-92 c8 System operations summary 





opi CRm op2 Name 


Description 










































































0 c3 0 TLBIALLIS Invalidate entire TLB Inner Shareable 
1 TLBIMVAIS Invalidate unified TLB entry by VA and ASID Inner Shareable 
2 TLBIASIDIS Invalidate unified TLB by ASID match Inner Shareable 
3 TLBIMVAAIS Invalidate unified TLB entry by VA all ASID Inner Shareable 
5 TLBIMVALIS Invalidate unified TLB entry by VA Inner Shareable, Last level 
7 TLBIMVAALIS Invalidate unified TLB by VA all ASID Inner Shareable, Last level 
c5 0 ITLBIALL Invalidate instruction TLB 
1 ITLBIMVA Invalidate instruction TLB entry by VA and ASID 
2 ITLBIASID Invalidate instruction TLB by ASID match 
c6 0 DTLBIALL Invalidate data TLB 
1 DTLBIMVA Invalidate data TLB entry by VA and ASID 
2 DTLBIASID Invalidate data TLB by ASID match 
c7 0 TLBIALL Invalidate unified TLB 
1 TLBIMVA Invalidate unified TLB by VA and ASID 
2 TLBIASID Invalidate unified TLB by ASID match 
3 TLBIMVAA Invalidate unified TLB entries by VA all ASID 
5 TLBIMVAL Invalidate last level of stage 1 TLB entry by VA 
7 TLBIMVAAL Invalidate last level of stage 1 TLB entry by VA all ASID 
4 c0 1 TLBIIPAS2IS TLB Invalidate entry by Intermediate Physical Address, Stage 2, Inner Shareable 
5 TLBIIPAS2LIS TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level, Inner Shareable 
c3 0 TLBIALLHIS Invalidate entire Hyp unified TLB Inner Shareable 
1 TLBIMVAHIS Invalidate Hyp unified TLB entry by VA Inner Shareable 
4 TLBIALLNSNHIS Invalidate entire Non-secure non-Hyp unified TLB Inner Shareable 
5 TLBIMVALHIS Invalidate Unified Hyp TLB entry by VA Inner Shareable, Last level 
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Table 4-92 c8 System operations summary (continued) 





op1 CRm op2 Name 


Description 




















c4 1 TLBIIPAS2 TLB Invalidate entry by Intermediate Physical Address, Stage 2 

5 TLBIIPAS2L TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level 
c7 0 TLBIALLH Invalidate entire Hyp unified TLB 

1 TLBIMVAH Invalidate Hyp unified TLB entry by VA 

4 TLBIALLNSNH Invalidate entire Non-secure non-Hyp unified TLB 

5 TLBIMVALH Invalidate Unified Hyp TLB entry by VA, Last level 





4.4.10 c9 registers 


The following table shows the System registers when CRn is c9 and the processor is in AArch32 state. 


Table 4-93 c9 register summary 

























































































opi CRm op2 Name Type Reset Description 
0 cl2 0 PMCR RW 0x41023000 Performance Monitors Control Register. See 77.4.1 Performance 
Monitors Control Register, ELO on page 11-401. 
E 1 PMCNTENSET RW UNK Performance Monitors Count Enable Set Register. 
o 2 PMCNTENCLR RW UNK Performance Monitors Count Enable Clear Register. >! 
o 3 PMOVSR RW UNK Performance Monitors Overflow Flag Status Register. >! 
o 4 PMSWINC WO - Performance Monitors Software Increment Register. »! 
o 5 PMSELR RW UNK Performance Monitors Event Counter Selection Register. ”! 
a 6 PMCEIDO RO @x7FFF@F3F Performance Monitors Common Event Identification Register 0. See 
11.4.2 Performance Monitors Common Event Identification Register 0, 
ELO on page 11-403. 
o 7 PMCEID1 RO  0x@@@@@000 Performance Monitors Common Event Identification Register 1. >! 
cl3 0 PMCCNTR RW UNK Performance Monitors Cycle Counter Register. ! 
o 1 PMXEVTYPER RW UNK Performance Monitors Selected Event Type Register. >! 
o PMCCFILTR RW @x000000OOO Performance Monitors Cycle Count Filter Register. ! 
oe 2 PMXEVCNTR RW UNK Performance Monitors Selected Event Count Register. ”! 
cl4 0 PMUSERENR RW _ @x@@00@@@@ Performance Monitors User Enable Register. ”! 
o 1 PMINTENSET RW UNK Performance Monitors Interrupt Enable Set Register. ™! 
a 2 PMINTENCLR RW UNK Performance Monitors Interrupt Event Clear Register. >! 
o 3 PMOVSSET RW UNK Performance Monitors Overflow Flag Status Set Register. >! 
1 c0 2 L2CTLR RW exeegeeeeee’™ L2 Control Register. See 4.3.58 L2 Control Register, ELI 
on page 4-168. 
o 3 L2ECTLR RW 0x00000000 L2 Extended Control Register. See 4.3.59 L2 Extended Control 


Register, ELI on page 4-172. 








bl See the ARM” Architecture Reference Manual ARMv8 for more information. 
bm The reset value depends on the processor implementation and the state of the LARSTDISABLE signal. 
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4.4.11 c10 registers 
The following table shows the System registers when CRn is c10 and the processor is in AArch32 state. 
Table 4-94 c10 register summary 
opi CRm op2 Name Type Reset Description 
0 c2 0 PRRR RW 0x@@098AA4 4.5.19 Primary Region Remap Register on page 4-272. 
o 0 MAIRO RW UNK 4.5.20 Memory Attribute Indirection Register 0 on page 4-273. 
o 1 NMRR RW = 0x44E@48E@ 4.5.21 Normal Memory Remap Register. on page 4-273. 
o 1 MAIRI RW UNK 4.5.22 Memory Attribute Indirection Register 1 on page 4-274. 
c3 0 AMAIRO RW UNK Auxiliary Memory Attribute Indirection Register 0. See 4.3.56 Auxiliary 
Memory Attribute Indirection Register, ELI and EL3 on page 4-168. 
o 1 AMAIRI RW UNK Auxiliary Memory Attribute Indirection Register 1. See 4.3.56 Auxiliary 
Memory Attribute Indirection Register, ELI and EL3 on page 4-168. 
4 c2 0 HMAIRO RW UNK Hyp Memory Attribute Indirection Register 0, See 4.3.57 Auxiliary Memory 
Attribute Indirection Register, EL2 on page 4-168. 
o 1 HMAIRI RW UNK Hyp Memory Attribute Indirection Register 1, See 4.3.57 Auxiliary Memory 
Attribute Indirection Register, EL2 on page 4-168. 
c3 0 HAMAIRO RW UNK Hyp Auxiliary Memory Attribute Indirection Register 0. See 4.3.57 Auxiliary 
Memory Attribute Indirection Register, EL2 on page 4-168. 
o 1 HAMAIRI RW UNK Hyp Auxiliary Memory Attribute Indirection Register 1. See 4.3.57 Auxiliary 
Memory Attribute Indirection Register, EL2 on page 4-168. 
4.4.12 c12 registers 
The following table shows the System registers when CRn is c12 and the processor is in AArch32 state. 
Table 4-95 c12 register summary 
op1 CRm op2 Name Type Reset Description 
0 c0 0 VBAR RW _ @xee@e@eeeee"" Vector Base Address Register. 
o 1 MVBAR RW UNK Monitor Vector Base Address Register. °° 
o 2 RMR RW  e@xeeeeeeee"? Reset Management Register. See 4.3.61 Reset Management Register, EL3 
on page 4-175. 
cl 0 ISR RO UNK Interrupt Status Register. °° 
4 c0 0 HVBAR RW UNK Hyp Vector Base Address Register. ?° 
4.4.13 c13 registers 





The following table shows the System registers when CRn is c13 and the processor is in AArch32 state. 


bn The reset value is @x@0@00000 for the Secure copy of the register. You must program the Non-secure copy of the register with the required initial value, as part of 
the processor boot sequence. 

bo See the ARM® Architecture Reference Manual ARMv8 for more information. 

bp The reset value of bit[0] depends on the AA64nAA32 signal. The following table assumes this signal is LOW. 
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Table 4-96 c13 register summary 
































op1 CRm op2 Name Type Reset Description 
0 c0 0 FCSEIDR RW 0x0000OOOO 4.5.23 FCSE Process ID 
Register on page 4-274 
1 CONTEXTIDR RW UNK Context ID Register 
2 TPIDRURW RW UNK User Read/Write Thread 
Pointer ID Register 4 
3 TPIDRURO Rw? UNK User Read-Only Thread 
Pointer ID Register °4 
4 TPIDRPRW RW UNK EL1 only Thread Pointer ID 
Register 64 
4 c0 2 HTPIDR RW UNK Hyp Thread Pointer ID 
Register °4 





4.4.14 c14 registers 


The following table shows the System registers when CRn is C14 and the processor is in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information about these registers. 


Table 4-97 c14 register summary 













































































op1 CRm op2 Name Type Reset Description 
0 c0 0 CNTFRQ RWS UNK Timer Counter Frequency register 
cl 0 CNTKCTL RW -bt EL1 Timer Control register 
c2 0 CNTP_TVAL RW UNK EL1 Physical Timer TimerValue register 
1 CNTP_CTL RW - EL1 Physical Timer Control register 
c3 0 CNTV_TVAL RW UNK Virtual Timer TimerValue register 
1 CNTV_CTL RW -bu Virtual Timer Control register 
c8 0 PMEVCNTRO RW UNK Performance Monitors Event Count Registers 
1 PMEVCNTR1 
2 PMEVCNTR2 
3 PMEVCNTR3 
4 PMEVCNTR4 
5 PMEVCNTRS5 
bq See the ARM® Architecture Reference Manual ARMv8 for more information. 
bs arse oe otherwise it is RO. 
bt The reset value for bits[9:8, 2:0] is @b00000. 
bu The reset value for bit[0] is 0. 
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Table 4-97 c14 register summary (continued) 






































op1 CRm op2 Name Type Reset Description 
cl2 0 PMEVTYPERO RW UNK Performance Monitors Event Type Registers 
1 PMEVTYPER1 
2 PMEVTYPER2 
3 PMEVTYPER3 
4 PMEVTYPER4 
5 PMEVTYPERS 
clS 7 PMCCFILTR RW @0x00000000 Performance Monitors Cycle Count Filter Register 
4 cl 0 CNTHCTL RW D EL2 Timer Control register 
c2 0 CNTHP_TVAL RW UNK EL2 Physical Timer TimerValue register 
1 CNTHP_ CTL RW -™ EL2 Physical Timer Control register 





4.4.15 c15 registers 


The following table shows the System registers when CRn is c15 and the processor is in AArch32 state. 


Table 4-98 c15 register summary 





























op1 CRm op2 Name Type Reset Description 
0 c0 0 ILIDATAO RW UNK 4.3.62 Instruction LI Data n Register, ELI on page 4-176. 
1 ILIDATA1 
2 IL1DATA2 
3 ILIDATA3 
cl 0 DLIDATAO RW UNK 4.3.63 Data LI Data n Register, EL1 on page 4-177. 








1 DLIDATA1 








2 DLIDATA2 








3 DLIDATA3 








4 DLIDATA4 





c4 0 RAMINDEX®* WỌ - 4.3.64 RAM Index operation on page 4-178. 





1 c0 0 L2ACTLR RW 0xee@eee010* L2 Auxiliary Control Register. See L2 Auxiliary Control Register, ELI. 





c3 0 CBAR RO -bY 4.5.24 Configuration Base Address Register on page 4-274. 





4.4.16 64-bit registers 


The following table gives a summary of the 64-bit wide System registers, accessed by the MCRR and MRRC 
instructions when the processor is in AArch32 state. 





bv The reset value for bit[2] is 0 and for bits[1:0] is @b11. 

bw  RAMINDEX is a system operation. 

bx The reset value is @x@@@@0010 for an ACE interface and @x@@004018 for a CHI interface. 
by The reset value depends on the primary input, PERIPHBASE[43:18]. 
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Table 4-99 64-bit register summary 


































































































CRn op1 CRm op2 Name Type Reset Description 
- 0 c2 - TTBRO RW UNK Translation Table Base Register 0. 
- 1 c2 - TTBR1 RW UNK Translation Table Base Register 1.7 
- 4 c2 - HTTBR RW UNK Hyp Translation Table Base Register. > 
- 6 c2 - VTTBR RW UNK® Virtualization Translation Table Base Register. >” 
- 0 c7 - PAR RW UNK 4.5.18 Physical Address Register on page 4-271. 
- 0 c9 - PMCCNTR RW - Performance Monitors Cycle Count Register. ?7 
- 0 cl4 - CNTPCT RO UNK Physical Timer Count register. 4 
- 1 cl4 - CNTVCT RO UNK Virtual Timer Count register. >” 
- 2 cl4 - CNTP_CVAL RW UNK ELI Physical Timer CompareValue register. >” 
- 3 cl4 - CNTV_CVAL RW UNK Virtual Timer CompareValue register. > 
- 4 cl4 - CNTVOFF RW UNK Virtual Timer Offset register. >” 
- 6 cl4 - CNTHP_CVAL RW UNK ElL2 Physical Timer CompareValue register. 7 
0 cli5S - CPUACTLR RW -b CPU Auxiliary Control Register. See 4.3.66 CPU Auxiliary Control 
Register, EL1 on page 4-194. 
1 cli5S - CPUECTLR RW -œe CPU Extended Control Register. See 4.3.67 CPU Extended Control 
Register, ELI on page 4-206. 
- 2 cli5S á - CPUMERRSR RW - CPU Memory Error Syndrome Register. See 4.3.68 CPU Memory Error 
Syndrome Register, EL1 on page 4-209. 
- 3 cl5S á - L2MERRSR RW -e L2 Memory Error Syndrome Register. See 4.3.69 L2 Memory Error 
Syndrome Register, EL1 on page 4-210. 
4.4.17 Identification registers 
The following table shows the Identification registers in AArch32 state. 
Table 4-100 Identification registers 
Name CRn op1 CRm op2 Type Reset Description 
MIDR c0 0 c0 0 RO 0©x41@FD@83 Main ID Register. See 4.3.7 Main ID Register, EL] on page 4-89. 
CTR 1 RO 0x8444C@04 Cache Type Register. See 4.3.26 Cache Type Register, ELO 
on page 4-121. 
TCMTR 2 - 0x00000000 4.5.1 TCM Type Register on page 4-239. 
TLBTR 3 RO ©x@0000008 4.5.2 TLB Type Register on page 4-239. 
MPIDR 5 RO 0x80000003° 4.5.3 Multiprocessor Affinity Register on page 4-240. 
bz See the ARM® Architecture Reference Manual ARMv8 for more information. 
Tooo 
F The reset value is 2x0000 001B 0009 2200. 


ce 


The reset value for bits[63,47:40,39:32,31] is zero. 
The reset value depends on the primary inputs, CLUSTERIDAFF1, and the number of processors that the MPCore device implements. The value shown is for a 
four processor implementation, with CLUSTERIDAFF1 set to zero. 
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Table 4-100 Identification registers (continued) 










































































Name CRn op1 CRm op2 Type Reset Description 

REVIDR 6 RO 0x@0000000 Revision ID Register. See 4.3.3 Revision ID Register, EL] 
on page 4-92. 

MIDR 4,7 RO  ©x41@FD@83 Aliases of Main ID Register, see 4.3.7 Main ID Register, EL1 
on page 4-89. 

ID_PFRO cl 0 RO 0x00000131 Processor Feature Register 0. See 4.3.4 AArch32 Processor Feature 
Register 0, ELI on page 4-93. 

ID_PFRI 1 RO x@@@11011% Processor Feature Register 1. See 4.3.5 AArch32 Processor Feature 
Register 1, ELI on page 4-94. 

ID_DFRO 2 RO 0x@3010066 Debug Feature Register 0. See 4.3.6 AArch32 Debug Feature 
Register 0, ELI on page 4-95. 

ID_AFRO 3 RO 0x0000000O = Auxiliary Feature Register 0. See 4.3.7 AArch32 Auxiliary Feature 
Register 0, ELI on page 4-96. 

ID_MMFRO 4 RO  0x10201105 Memory Model Feature Register 0. See 4.3.8 AArch32 Memory 
Model Feature Register 0, EL1 on page 4-96. 

ID_MMEFRI1 5 RO 0x40000000 Memory Model Feature Register 1. See 4.3.9 AArch32 Memory 
Model Feature Register 1, ELI on page 4-98. 

ID_MMFR2 6 RO 0x@1260008@ Memory Model Feature Register 2. See 4.3.10 AArch32 Memory 
Model Feature Register 2, EL1 on page 4-99. 

ID_MMFR3 7 RO  @x@2102211 Memory Model Feature Register 3. See 4.3.17 AArch32 Memory 
Model Feature Register 3, EL1 on page 4-101. 

ID_ISARO c2 0 RO @x@210111@ Instruction Set Attribute Register 0. See 4.3.12 AArch32 Instruction 
Set Attribute Register 0, EL] on page 4-103 

ID_ISARI 1 RO = @x13112111 Instruction Set Attribute Register 1. See 4.3.13 AArch32 Instruction 
Set Attribute Register 1, EL1 on page 4-104. 

ID_ISAR2 2 RO  0x21232042 Instruction Set Attribute Register 2. See 4.3.14 AArch32 Instruction 
Set Attribute Register 2, EL1 on page 4-106. 

ID_ISAR3 3 RO = 6x@1112131 Instruction Set Attribute Register 3. See 4.3.15 AArch32 Instruction 
Set Attribute Register 3, EL1 on page 4-107. 

ID_ISAR4 4 RO ©x@@@11142 Instruction Set Attribute Register 4. See 4.3.16 AArch32 Instruction 
Set Attribute Register 4, EL1 on page 4-108. 

ID_ISARS5 5 RO 0x0@010001°° Instruction Set Attribute Register 5. See 4.3.17 AArch32 Instruction 
Set Attribute Register 5, EL1 on page 4-110. 

CCSIDR 1 c0 0 RO UNK Cache Size ID Register. See 4.3.22 Cache Size ID Register, EL1 
on page 4-117. 

CLIDR 1 RO @x@A200@23 Cache Level ID Register. See 4.3.23 Cache Level ID Register, EL] 
on page 4-118. 

AIDR T - 0x00000000 Auxiliary ID Register. See 4.3.24 Auxiliary ID Register, EL1 
on page 4-120. 

CSSELR 2 c0 0 RW UNK Cache Size Selection Register. See 4.3.25 Cache Size Selection 


Register, EL1 on page 4-120. 








cf The reset value depends on the primary input GICCDISABLE. The value shown assumes the GICCDISABLE signal is tied HIGH. 
C8 The reset value is 0x00011121 if the Cryptography engine is implemented. 





ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 


4-226 


Non-Confidential 


4 System Control 
4.4 AArch32 register summary 


Table 4-100 Identification registers (continued) 















































Name CRn op1 CRm op2 Type Reset Description 
VPIDR 4 c0 0 RW -h Virtualization Processor ID Register. See 4.3.28 Virtualization 
Processor ID Register, EL2 on page 4-123. 
VMPIDR S RO -Ää Virtualization Multiprocessor ID Register. See 4.5.4 Virtualization 
Multiprocessor ID Register on page 4-241. 
4.4.18 CPUID registers 
The following table shows the CPUID registers in AArch32 state. 
Table 4-101 CPUID registers 

Name CRn op1 CRm op2 Type Reset Description 

ID_PFRO c0 0 cl 0 RO 0x00000131 Processor Feature Register 0. See 4.3.4 AArch32 
Processor Feature Register 0, EL] on page 4-93. 

ID_PFRI 1 RO 0x00011011% Processor Feature Register 1. See 4.3.5 AArch32 
Processor Feature Register 1, EL] on page 4-94. 

ID_DFRO 2 RO @x@3010066 Debug Feature Register 0. See 4.3.6 AArch32 Debug 
Feature Register 0, ELI on page 4-95. 

ID_AFRO 3 RO 0x00000000 Auxiliary Feature Register 0. See 4.3.7 AArch32 
Auxiliary Feature Register 0, ELI on page 4-96. 

ID_MMFRO 4 RO @x10201105 Memory Model Feature Register 0. See 
4.3.8 AArch32 Memory Model Feature Register 0, 
ELI on page 4-96. 

ID_MMEFRI1 5 RO @x40000000 Memory Model Feature Register 1. See 
4.3.9 AArch32 Memory Model Feature Register 1, 
ELI on page 4-98. 

ID_MMFR2 6 RO @x@126000@ Memory Model Feature Register 2. See 
4.3.10 AArch32 Memory Model Feature Register 2, 
ELI on page 4-99. 

ID_MMFR3 7 RO @x@2102211 Memory Model Feature Register 3. See 
4.3.11 AArch32 Memory Model Feature Register 3, 
ELI on page 4-101. 

ch 


ci The reset value is the value of the Multiprocessor Affinity Register. 
© The reset value depends on the primary input GICCDISABLE. The value shown assumes the GICCDISABLE signal is tied HIGH. 


The reset value is the value of the Main ID Register. See 4.3.7 Main ID Register, EL] on page 4-89 for more information. 
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Table 4-101 CPUID registers (continued) 





Name CRn op1 CRm op2 Type Reset Description 





ID_ISARO c0 0 c2 0 RO @x@2101110 Instruction Set Attribute Register 0. See 
4.3.12 AArch32 Instruction Set Attribute Register 0, 
ELI on page 4-103. 





ID_ISARI 1 RO @x13112111 Instruction Set Attribute Register 1. See 
4.3.13 AArch32 Instruction Set Attribute Register 1, 
ELI on page 4-104. 





ID_ISAR2 2 RO @x21232042 Instruction Set Attribute Register 2. See 
4.3.14 AArch32 Instruction Set Attribute Register 2, 
ELI on page 4-106. 





ID_ISAR3 3 RO @x@1112131 Instruction Set Attribute Register 3. See 
4.3.15 AArch32 Instruction Set Attribute Register 3, 
ELI on page 4-107. 





ID_ISAR4 4 RO 0x00011142 Instruction Set Attribute Register 4. See 
4.3.16 AArch32 Instruction Set Attribute Register 4, 
ELI on page 4-108. 





ID_ISAR5 5 RO @x@0000001" Instruction Set Attribute Register 5. See 
4.3.17 AArch32 Instruction Set Attribute Register 5, 
ELI on page 4-110. 





4.4.19 Virtual memory control registers 


The following table shows the Virtual memory control registers in AArch32 state. 


Table 4-102 Virtual memory control registers 






































Name CRn op1 CRm op2 Type Reset Width Description 
SCTLR cl 0 c0 0 RW  @x@@C5@838° 32-bit 4.5.5 System Control Register on page 4-242. 
HSCTLR cl 4 c0 0 RW = 0x30C50838 32-bit Hyp System Control Register. 
TTBRO c2 0 c0 0 RW UNK 32-bit 
——— Translation Table Base Register 0. “™ 
- 0 c2 - 64-bit 
TTBR1 c2 0 c0 1 RW UNK 32-bit 
——— Translation Table Base Register 1. °™ 
- 1 c2 - 64-bit 
TTBCR c2 0 c0 2 RW 0xeeeee808 32-bit 4.5.15 Translation Table Base Control Register 
on page 4-265. 
HTCR c2 4 c0 2 RW UNK 32-bit 4.5.16 Hyp Translation Control Register on page 4-266. 
VTCR cl 2 RW UNK 32-bit Virtualization Translation Control Register. “™ 
DACR c3 0 c0 0 RW UNK 32-bit Domain Access Control Register. “” 
ck 





The reset value is 0x@0001121 if the Cryptography engine is implemented. 
cl The reset value depends on primary inputs, CFGTE, CFGEND, and VINITHI. Table 4-102 Virtual memory control registers on page 4-228 assumes these signals 
are LOW. 
cm See the ARM” Architecture Reference Manual ARMv8 for more information. 
cn The reset value is @x@0000000 for the Secure copy of the register. The reset value for the EAE bit of the Non-secure copy of the register is @x@. You must program 
the Non-secure copy of the register with the required initial value, as part of the processor boot sequence. 
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Table 4-102 Virtual memory control registers (continued) 

















Name CRn op1 CRm op2 Type Reset Width Description 
PRRR cl0 0 c2 0 RW @x@@@98AA4 32-bit 4.5.19 Primary Region Remap Register on page 4-272. 
MAIRO 0 RW UNK 32-bit 4.5.20 Memory Attribute Indirection Register 0 

on page 4-273. 
NMRR 1 RW 0x44E@48E@ 32-bit 4.5.21 Normal Memory Remap Register. on page 4-273. 
MAIRI 1 RW UNK 32-bit 4.5.22 Memory Attribute Indirection Register 1 


on page 4-274. 





AMAIRO c3 0 RW UNK 32-bit Auxiliary Memory Attribute Indirection Register 0. See 
4.3.56 Auxiliary Memory Attribute Indirection Register, 
EL1 and EL3 on page 4-168. 





AMAIR1 1 RW UNK 32-bit Auxiliary Memory Attribute Indirection Register 1. See 
4.3.56 Auxiliary Memory Attribute Indirection Register, 
EL1 and EL3 on page 4-168. 











HMAIRO 4 c2 0 RW UNK 32-bit Hyp Memory Attribute Indirection Register 0. °™ 
HMAIR1 1 RW UNK 32-bit Hyp Memory Attribute Indirection Register 1.°™ 
HAMAIRO c3 0 RW UNK 32-bit Hyp Auxiliary Memory Attribute Indirection Register 0. 


See 4.3.57 Auxiliary Memory Attribute Indirection 
Register, EL2 on page 4-168. 





HAMAIRI1 1 RW UNK 32-bit Hyp Auxiliary Memory Attribute Indirection Register 1. 
See 4.3.57 Auxiliary Memory Attribute Indirection 
Register, EL2 on page 4-168. 





CONTEXTIDR c13 0 c0 1 RW UNK 32-bit Context ID Register. “™ 





4.4.20 Fault and Exception handling registers 


The following table shows the Fault handling registers in AArch32 state. 


Table 4-103 Fault and Exception handling registers 














Name CRn op1 CRm op2 Type Reset Description 
DFSR c5 0 c0 0 RW UNK 4.5.17 Data Fault Status Register on page 4-267. 
IFSR 1 RW UNK Instruction Fault Status Register. See 4.3.57 Instruction Fault Status 


Register, EL2 on page 4-159. 





ADFSR cl 0 RW UNK Auxiliary Data Fault Status Register. See 4.3.48 Auxiliary Fault Status 
Register 0, ELI and EL3 on page 4-156. 

















AIFSR 1 RW UNK Auxiliary Instruction Fault Status Register. See 4.3.49 Auxiliary Fault 
Status Register 1, EL] and EL3 on page 4-157. 
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Table 4-103 Fault and Exception handling registers (continued) 




































































Name CRn op1 CRm op2 Type Reset Description 

HADFSR 4 cl 0 RW UNK Hyp Auxiliary Data Fault Status Register. See 4.3.52 Auxiliary Fault 
Status Register 0, EL2 and Hyp Auxiliary Data Fault Status Register 
on page 4-163. 

HAIFSR 1 RW UNK Hyp Auxiliary Instruction Fault Status Register. See 4.3.53 Auxiliary 
Fault Status Register 1, EL2 and Hyp Auxiliary Instruction Fault Status 
Register on page 4-163. 

HSR c2 0 RW UNK Hyp Syndrome Register. See 4.3.54 Exception Syndrome Register, EL2 
on page 4-163. 

DFAR c6 0 c0 0 RW UNK Data Fault Address Register. 

IFAR 2 RW UNK Instruction Fault Address Register. “° 

HDFAR 4 c0 0 RW UNK Hyp Data Fault Address Register. °° 

HIFAR 2 RW UNK Hyp Instruction Fault Address Register. °° 

HPFAR 4 RW UNK Hyp IPA Fault Address Register. °° 

VBAR cl2 0 c0 0 RW 0x00000000°P Vector Base Address Register. °° 

MVBAR 1 RW UNK Monitor Vector Base Address Register. °° 

RMR 2 RW 0x00000000°1 Reset Management Register. See 4.3.53 Auxiliary Fault Status Register 
1, EL2 and Hyp Auxiliary Instruction Fault Status Register 
on page 4-163. 

ISR cl 0 RO UNK Instruction Status Register. °° 

HVBAR 4 c0 2 RW UNK Hyp Vector Base Address Register. °° 





The Virtualization registers include additional fault handling registers. For more information see 
4.4.28 Virtualization registers on page 4-234. 


4.4.21 Other System registers 


The following table shows the other System registers in AArch32 state. 


Table 4-104 Other System registers 

















Name CRn op1 CRm op2 Type Reset Description 

ACTLR cl 0 c0 1 - 0x00000000 Auxiliary Control Register. See 4.3.39 Auxiliary Control Register, EL3 
on page 4-143. 

CPACR 2 RW @0Xx0OOOOOOO 4.5.6 Architectural Feature Access Control Register on page 4-247. 

HACTLR 4 c0 1 RW 0x00000000 Hyp Auxiliary Control Register. See 4.3.33 Auxiliary Control Register, 
EL2 on page 4-130. 

FCSEIDR c13 0 c0 0 RW 0x0000000O 4.5.23 FCSE Process ID Register on page 4-274. 








cO See the ARM” Architecture Reference Manual ARMV8 for more information. 
cP The reset value is @x@0000000 for the Secure copy of the register. You must program the Non-secure copy of the register with the required initial value, as part of 


the processor boot sequence. 


cq The reset value of bit[0] depends on the AA64nAA32 signal. Table 4-103 Fault and Exception handling registers on page 4-229 assumes this signal is LOW. 
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The following table shows the System instructions for cache and branch predictor maintenance 
operations in AArch32 state. See the ARM® Architecture Reference Manual ARMv8 for more information 


about these operations. 


Table 4-105 Cache and branch predictor maintenance operations 





Name CRn op1 CRm op2 Description 





ICIALLUIS c7 


cl 0 Instruction Cache invalidate all to PoU™ Inner Shareable 





BPIALLIS 





6 Branch predictor invalidate all Inner Shareable 





ICIALLU 


c5 0 Instruction Cache invalidate all to PoU 





ICIMVAU 





1 Instruction Cache invalidate by VA to PoU 





BPIALL 





6 Branch predictor invalidate all 





BPIMVA 





7 Branch predictor invalidate by VA 





DCIMVAC 


c6 1 Data cache invalidate by VA to PoC® 





DCISW 





2 Data cache invalidate by set/way 





DCCMVAC 


cl0 1 Data cache clean by VA to PoC 





DCCSW 





2 Data cache clean by set/way 





DCCMVAU 


cll 1 Data cache clean by VA to PoU 





DCCIMVAC 


cl4 1 Data cache clean and invalidate by VA to PoC 





DCCISW 





2 Data cache clean and invalidate by set/way 





4.4.23 TLB maintenance operations 


The following table shows the System instructions for TLB maintenance operations in AArch32 state. 
See the ARM® Architecture Reference Manual ARMV8 for more information about these operations. 


Table 4-106 TLB maintenance operations 





















































Name CRn op1 CRm op2 Description 

TLBIALLIS c8 0 c3 0 Invalidate entire unified TLB Inner Shareable 

TLBIMVAIS 1 Invalidate unified TLB by VA and ASID Inner Shareable 
TLBIASIDIS 2 Invalidate unified TLB by ASID Inner Shareable 

TLBIMVAAIS 3 Invalidate unified TLB by VA all ASID Inner Shareable 
TLBIMVALIS 5 Invalidate unified TLB entry by VA Inner Shareable, Last level 
TLBIMVAALIS T Invalidate unified TLB by VA all ASID Inner Shareable, Last level 
ITLBIALL c5 0 Invalidate entire instruction TLB 

ITLBIMVA 1 Invalidate instruction TLB entry by VA and ASID 

ITLBIASID 2 Invalidate instruction TLB by ASID 








cr PoU = Point of Unification. PoU is set by the BROADCASTINNER signal and can be in the L1 data cache or outside of the processor, in which case PoU is 


dependent on the external memory system. 
cs 


PoC = Point of Coherence. The PoC is always outside of the processor and is dependent on the external memory system. 
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Table 4-106 TLB maintenance operations (continued) 





















































Name CRn op1 CRm op2 Description 

DTLBIALL c6 0 Invalidate entire data TLB 

DTLBIMVA 1 Invalidate data TLB entry by VA and ASID 
DTLBIASID 2 Invalidate data TLB by ASID 

TLBIALL c7 0 Invalidate entire unified TLB 

TLBIMVA 1 Invalidate unified TLB by VA and ASID 
TLBIASID 2 Invalidate unified TLB by ASID 

TLBIMVAA 3 Invalidate unified TLB by VA all ASID 
TLBIMVAL 5 Invalidate unified TLB entry by VA, Last level 
TLBIMVAAL 7 Invalidate unified TLB by VA all ASID, Last level 





The Virtualization registers include additional TLB operations for use in Hyp mode. 


Related information 
4.2.13 AArch64 EL2 TLB maintenance operations on page 4-85. 


4.4.24 Address translation operations 


The following table shows the address translation register in AArch32 state. 


Table 4-107 Address translation register 





Name CRn op1 CRm op2 Reset Width Description 





PAR 


c7 0 c4 


0 


UNK 32-bit 





- 0 c7 


64-bit 


4.5.18 Physical Address Register on page 4-271 





The following table shows the System instructions for address translation operations in AArch32 state. 


Table 4-108 Address translation operations 















































Name CRn op1 CRm op2 Reset Width Description 
ATS1CPR c7 0 c8 0 UNK 32-bit Stage 1 current state EL1 read 
ATS1CPW 1 UNK 32-bit Stage 1 current state EL1 write t 
ATS1CUR 2 UNK 32-bit Stage 1 current state unprivileged read “ 
ATS1CUW 3 UNK 32-bit Stage 1 current state unprivileged write °t 
ATS12NSOPR 4 UNK 32-bit Stages 1 and 2 Non-secure EL1 read “t 
ATS12NSOPW 5 UNK 32-bit Stages 1 and 2 Non-secure EL1 write “t 
ATS12NSOUR 6 UNK 32-bit Stages 1 and 2 Non-secure unprivileged read ĉt 
ATS12NSOUW 7 UNK 32-bit Stages 1 and 2 Non-secure unprivileged write ®t 
ct See the ARM” Architecture Reference Manual ARMV8 for more information. 
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Table 4-108 Address translation operations (continued) 






























































Name CRn op1 CRm op2 Reset Width Description 
ATS1HR 4 c8 0 UNK 32-bit Stage 1 Hyp mode read ®t 
ATS1HW 1 UNK 32-bit Stage 1 Hyp mode write “ 
4.4.25 Miscellaneous operations 
The following table shows the System instructions and the registers for miscellaneous operations in 
AArch32 state. 
Table 4-109 Miscellaneous System operations 
Name CRn op1 CRm op2 Type Reset Description 
CP15ISB c7 4 c5 4 - UNK Instruction Synchronization Barrier operation, this operation is deprecated in 
ARMv8-A 
CP15DSB clo 4 - UNK Data Synchronization Barrier operation, this operation is deprecated in 
ARMv8-A 
CP15DMB 5 - UNK Data Memory Barrier operation, this operation is deprecated in ARMv8-A 
TPIDRURW c13 0 c0 2 RW UNK User Read/Write Thread ID Register 
TPIDRURO 3 RW‘Y UNK Ell only Thread ID Register ° 
TPIDRPRW 4 RW UNK Hyp Software Thread ID Register ®" 
HTPIDR 4 c0 2 RW UNK User Read-Only Thread ID Register °" 
4.4.26 Performance Monitors registers 


The following table shows the Performance Monitors registers in AArch32 state. 


Table 4-110 Performance Monitors registers 

































































Name CRn op1 CRm op2 Type Reset Description 

PMCR c9 0 cl2 0 RW = 0x41023@0@ Performance Monitors Control Register. See 77.4.1 Performance 
Monitors Control Register, ELO on page 11-401. 

PMCNTENSET 1 RW UNK Performance Monitors Count Enable Set Register. 

PMCNTENCLR 2 RW UNK Performance Monitors Count Enable Clear Register. °W 

PMOVSR 3 RW UNK Performance Monitors Overflow Flag Status Register. “ 

PMSWINC 4 WO - Performance Monitors Software Increment Register. °Y 

PMSELR 5 RW UNK Performance Monitors Event Counter Selection Register. Y 

PMCEIDO 6 RO ©x7FFF@F3F Performance Monitors Common Event Identification Register 0. 
See 71.4.2 Performance Monitors Common Event Identification 
Register 0, ELO on page 11-403. 

PMCEID1 7 RO UNK Performance Monitors Common Event Identification Register 1. °W 








cu See the ARM” Architecture Reference Manual ARMV8 for more information. 
CV RO at ELO. 
CW See the ARM” Architecture Reference Manual ARMVv8 for more information. 
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Table 4-110 Performance Monitors registers (continued) 















































Name CRn op1 CRm op2 Type Reset Description 

PMCCNTR cl3 0 RW UNK Performance Monitors Cycle Count Register. W 
PMXEVTYPER 1 RW UNK Performance Monitors Selected Event Type Register. “W 
PMCCFILTR RW 0x0@0@80008 Performance Monitors Cycle Count Filter Register. W 
PMXEVCNTR 2 RW UNK Performance Monitors Selected Event Count Register. °W 
PMUSERENR cl4 0 RW 0x0@000008 Performance Monitors User Enable Register. °” 
PMINTENSET 1 RW UNK Performance Monitors Interrupt Enable Set Register. ©W 
PMINTENCLR 2 RW UNK Performance Monitors Interrupt Enable Clear Register. ®W 
PMOVSSET 3 RW UNK Performance Monitors Overflow Flag Status Set Register. ®W 




















4.4.27 Security registers 


The following table shows the 32-bit wide Security registers in AArch32 state. 


Table 4-111 Security registers 


Name CRn op1 CRm op2 Type Reset Description 





SCR cl 0 cl 0 RW 0xe@ee00000 4.5.7 Secure Configuration Register on page 4-248 

















SDER 1 RW @0x0000000O Secure Debug Enable Register 
NSACR 2 RW 0x@0008008 4.5.8 Non-secure Access Control Register on page 4-251 
SDCR c3 1 RW 0x00000000 4.5.9 Secure Debug Configuration Register on page 4-252 





VBAR cl2 0 c0 0 RW 0x00000000° Vector Base Address Register ™ 











MVBAR 1 RW UNK Monitor Vector Base Address Register °% 
ISR cl 0 RO UNK Interrupt Status Register °% 
4.4.28 Virtualization registers 


The following table shows the Virtualization registers in AArch32 state. 


Table 4-112 Virtualization registers 





Name CRn op1 CRm op2 Type Reset Width Description 





VPIDR c0 4 c0 0 RW -7 32-bit Virtualization Processor ID Register. See 4.3.28 Virtualization 
Processor ID Register, EL2 on page 4-123. 





VMPIDR 5 RO -® 32-bit 4.5.4 Virtualization Multiprocessor ID Register 
on page 4-241. 








CX See the ARM” Architecture Reference Manual ARMV8 for more information. 

CY The reset value is @x@00000@0 for the Secure copy of the register. You must program the Non-secure copy of the register with the required initial value, as part of 
the processor boot sequence. 

CZ The reset value is the value of the Main ID Register. 

da The reset value is the value of the Multiprocessor Affinity Register. 
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Table 4-112 Virtualization registers (continued) 























































































































Name CRn op1 CRm op2 Type Reset Width Description 

HSCTLR cl 4 c0 0 RW = 0x30C50838 32-bit Hyp System Control Register. 

HACTLR 1 RW 0x00000000 32-bit Hyp Auxiliary Control Register. See 4.3.33 Auxiliary Control 
Register, EL2 on page 4-130. 

HCR cl 0 RW 0x@0000008 32-bit 4.5.10 Hyp Configuration Register on page 4-254. 

HDCR 1 RW 0xee@e@ee0e6"° 32-bit 4.5.12 Hyp Debug Control Register on page 4-261. 

HCPTR 2 RW 0x000033FF 32-bit 4.5.13 Hyp Architectural Feature Trap Register 
on page 4-263. 

HSTR 3 RW 0x00000000 32-bit Hyp System Trap Register. See 4.3.36 Hypervisor System 
Trap Register on page 4-139. 

HCR2 4 RW 0x@0000000 32-bit 4.5.11 Hyp Configuration Register 2 on page 4-259. 

HACR 7 RW 0x00000000 32-bit 4.3.37 Hyp Auxiliary Configuration Register on page 4-141. 

HTCR c2 4 c0 2 RW UNK 32-bit 4.5.16 Hyp Translation Control Register on page 4-266. 

VTCR cl 2 RW UNK 32-bit Virtualization Translation Control Register. “> 

HTTBR - 4 c2 - RW UNK 64-bit Hyp Translation Table Base Register. “ 

VTTBR - 6 c2 - RW UNK% 64-bit Virtualization Translation Table Base Register. 

HADFSR c5 4 cl 0 RW UNK 32-bit Hyp Auxiliary Data Fault Status Register. See 
4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp 
Auxiliary Data Fault Status Register on page 4-163. 

HAIFSR 1 RW UNK 32-bit Hyp Auxiliary Instruction Fault Status Register. See 
4.3.53 Auxiliary Fault Status Register 1, EL2 and Hyp 
Auxiliary Instruction Fault Status Register on page 4-163. 

HSR c2 0 RW UNK 32-bit Hyp Syndrome Register. See 4.3.54 Exception Syndrome 
Register, EL2 on page 4-163. 

HDFAR c6 4 cO 0 RW -€ 32-bit Hyp Data Fault Address Register. 1 

HIFAR 2 RW -f 32-bit Hyp Instruction Fault Address Register. 

HPFAR 4 RW UNK 32-bit Hyp IPA Fault Address Register. “ 

HMAIRO cl0 4 c2 0 RW UNK 32-bit Hyp Memory Attribute Indirection Register 0. 1 

HMAIRI1 1 RW UNK 32-bit Hyp Memory Attribute Indirection Register 1. 1 

HAMAIRO c3 0 RW UNK 32-bit Hyp Auxiliary Memory Attribute Indirection Register 0. See 
4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 
on page 4-168. 

HAMAIR1 1 RW UNK 32-bit Hyp Auxiliary Memory Attribute Indirection Register 1. See 
4.3.57 Auxiliary Memory Attribute Indirection Register, EL2 
on page 4-168. 

HVBAR cl2 4 cO0 0 RW UNK 32-bit Hyp Vector Base Address Register. “> 








db See the ARM® Architecture Reference Manual ARMv8 for more information. 


dc The reset value for bit[7] is UNK. 

dd The reset value for bits[55:48] is 500000000. 

The reset value is the value of the Secure copy of the DFAR register. 
The reset value is the value of the Secure copy of the IFR register. 


de 
df 
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4.4.29 Hyp mode TLB maintenance operations 


The following table shows the System instructions for TLB maintenance operations added for 
Virtualization in AArch32 state. See the ARM® Architecture Reference Manual ARMV8 for more 
information about these operations. 


Table 4-113 Hyp mode TLB maintenance operations 
















































































Name CRn op1 CRm op2 Description 
TLBIIPAS2I1S c8 4 c0 1 TLB Invalidate entry by Intermediate Physical Address, Stage 2, Inner Shareable 
TLBIIPAS2LIS 5 TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level, Inner 
Shareable 
TLBIALLHIS c3 0 Invalidate entire Hyp unified TLB Inner Shareable 
TLBIMVAHIS 1 Invalidate Hyp unified TLB by VA Inner Shareable 
TLBIALLNSNHIS 4 Invalidate entire Non-secure Non-Hyp unified TLB Inner Shareable 
TLBIMVALHIS 5 Invalidate Unified Hyp TLB entry by VA Inner Shareable, Last level 
TLBIIPAS2 c4 1 TLB Invalidate entry by Intermediate Physical Address, Stage 2 
TLBIIPAS2L 5 TLB Invalidate entry by Intermediate Physical Address, Stage 2, Last level 
TLBIALLH c8 4 c7 0 Invalidate entire Hyp unified TLB 
TLBIMVAH 1 Invalidate Hyp unified TLB by VA 
TLBIALLNSNH 4 Invalidate entire Non-secure Non-Hyp unified TLB 
TLBIMVALH 5 Invalidate Unified Hyp TLB entry by VA, Last level 
4.4.30 Generic Timer registers 
See 9.3 Generic Timer register summary on page 9-341 for information on the Generic Timer registers. 
4.4.31 Implementation defined registers 
The following table shows the IMPLEMENTATION DEFINED registers in AArch32 state. These registers provide 
test features and any required configuration options specific to the Cortex-A72 processor. 
Table 4-114 IMPLEMENTATION DEFINED registers 
Name CRn op1 CRm op2 Type Reset Width Description 
AIDR c0 1 c0 7 - 0x00000000 32-bit Auxiliary ID Register. See 4.3.24 Auxiliary ID Register, 
ELI on page 4-120. 
ACTLR cl 0 c0 1 - 0x0000000O 32-bit Auxiliary Control Register. See 4.3.39 Auxiliary Control 
Register, EL3 on page 4-143. 
HACTLR 4 c0 1 RW 0x00000000 32-bit Hyp Auxiliary Control Register. See 4.3.33 Auxiliary 


Control Register, EL2 on page 4-130. 
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Table 4-114 IMPLEMENTATION DEFINED registers (continued) 






























































Name CRn op1 CRm op2 Type Reset Width Description 

HADFSR c5 4 cl 0 RW UNK 32-bit Hyp Auxiliary Data Fault Status Register. See 
4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp 
Auxiliary Data Fault Status Register on page 4-163. 

HAIFSR 1 RW UNK 32-bit Hyp Auxiliary Instruction Fault Status Register. See 
4.3.52 Auxiliary Fault Status Register 0, EL2 and Hyp 
Auxiliary Data Fault Status Register on page 4-163. 

L2CTLR c9 1 c0 2 RW 0@xee@eegeeee"2 32-bit L2 Control Register. See 4.3.58 L2 Control Register, EL1 
on page 4-168. 

L2ECTLR 3 RW 0x0000000O 32-bit L2 Extended Control Register. See 4.3.59 L2 Extended 
Control Register, EL1 on page 4-172. 

AMAIRO cl0 0 c3 0 RW UNK 32-bit Auxiliary Memory Attribute Indirection Register 0. See 
4.3.56 Auxiliary Memory Attribute Indirection Register, 
EL1 and EL3 on page 4-168. 

AMAIR1 1 RW UNK 32-bit Auxiliary Memory Attribute Indirection Register 1. See 
4.3.56 Auxiliary Memory Attribute Indirection Register, 
EL1 and EL3 on page 4-168. 

HAMAIRO 0 RW UNK 32-bit Hyp Auxiliary Memory Attribute Indirection Register 0. 
See 4.3.57 Auxiliary Memory Attribute Indirection 
Register, EL2 on page 4-168. 

HAMAIRI1 1 RW UNK 32-bit Hyp Auxiliary Memory Attribute Indirection Register 1. 
See 4.3.57 Auxiliary Memory Attribute Indirection 
Register, EL2 on page 4-168. 

ILIDATAO clS 0 c0 0 RW UNK 32-bit 4.3.62 Instruction L1 Data n Register, EL] on page 4-176. 

ILIDATA1 1 

IL1DATA2 2 

IL1DATA3 3 

DLIDATAO cl 0 RW UNK 32-bit 4.3.63 Data LI Data n Register, EL] on page 4-177. 

DLIDATA1 1 

DLIDATA2 2 

DLIDATA3 3 

DLIDATA4 4 

RAMINDEX c4 0 WO - 32-bit 4.3.64 RAM Index operation on page 4-178. 

L2ACTLR 1 c0 0 RW 0xe@e@e@00010"" 32-bit L2 Auxiliary Control Register. See L2 Auxiliary Control 
Register, EL. 

CBAR 4 c0 0 RO -# 32-bit 4.5.24 Configuration Base Address Register 


on page 4-274>. 








dg The reset value depends on the processor implementation and the state of the LARSTDISABLE signal. 
dh The reset value is @x@0000010 for an ACE interface and @x@0004018 for a CHI interface. 
di The reset value depends on the primary input, PERIPHBASE[43:18]. 
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Table 4-114 IMPLEMENTATION DEFINED registers (continued) 














Name CRn op1 CRm op2 Type Reset Width Description 

CPUACTLR - 0 cl5S - RW -4 64-bit CPU Auxiliary Control Register. See 4.3.66 CPU 
Auxiliary Control Register, EL] on page 4-194. 

CPUECTLR - 1 - RW -ck 64-bit CPU Extended Control Register. See 4.3.67 CPU 
Extended Control Register, EL] on page 4-206. 

CPUMERRSR - 2: - RW 64-bit CPU Memory Error Syndrome Register. See 4.3.68 CPU 


Memory Error Syndrome Register, EL] on page 4-209. 














L2MERRSR~ - 3 - RW -i 64-bit L2 Memory Error Syndrome Register. See 4.3.69 L2 
Memory Error Syndrome Register, EL] on page 4-210. 
dj The reset value is zero. 
dk The reset value is 0x000 001B 000A 0200. 
dl The reset value for bits[63,47:40,39:32,31] is zero. 
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4.5 AArch32 register descriptions 


This section describes all the System registers in register number order when the processor is in AArch32 
state. 


Table 4-84 c0 register summary on page 4-215 to Table 4-99 64-bit register summary on page 4-225 
provide cross-references to individual registers. 


This section contains the following subsections: 

e 4.5.1 TCM Type Register on page 4-239. 

e 4.5.2 TLB Type Register on page 4-239. 

e 4.5.3 Multiprocessor Affinity Register on page 4-240. 

¢ 4.5.4 Virtualization Multiprocessor ID Register on page 4-241. 
e 4.5.5 System Control Register on page 4-242. 

e 4.5.6 Architectural Feature Access Control Register on page 4-247. 
e 4.5.7 Secure Configuration Register on page 4-248. 

e 4.5.8 Non-secure Access Control Register on page 4-251. 

e 4.5.9 Secure Debug Configuration Register on page 4-252. 

¢ 4.5.10 Hyp Configuration Register on page 4-254. 

¢ 4.5.11 Hyp Configuration Register 2 on page 4-259. 

e 4.5.12 Hyp Debug Control Register on page 4-261. 

e 4.5.13 Hyp Architectural Feature Trap Register on page 4-263. 
¢ 4.5.14 Translation Table Base Register 0 and Register 1 on page 4-265. 
e 4.5.15 Translation Table Base Control Register on page 4-265. 
¢ 4.5.16 Hyp Translation Control Register on page 4-266. 

¢ 4.5.17 Data Fault Status Register on page 4-267. 

e 4.5.18 Physical Address Register on page 4-271. 

e 4.5.19 Primary Region Remap Register on page 4-272. 

e 4.5.20 Memory Attribute Indirection Register 0 on page 4-273. 
¢ 4.5.21 Normal Memory Remap Register. on page 4-273. 

e 4.5.22 Memory Attribute Indirection Register 1 on page 4-274. 
e 4.5.23 FCSE Process ID Register on page 4-274. 

e 4.5.24 Configuration Base Address Register on page 4-274. 


4.5.1 TCM Type Register 


The processor does not implement instruction or data Tightly Coupled Memory (TCM), so this register is 
always RESO. 


4.5.2 TLB Type Register 


The TLBTR characteristics are: 


Purpose 

Provides information about the TLB implementation. 
Usage constraints 

The accessibility to the TLBTR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 








- RO RO RO RO RO 
Configurations 
The TLBTR is Common to Secure and Non-secure states. 
Attributes 


See the register summary in Table 4-84 c0 register summary on page 4-215. 
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The following figure shows the TLBTR bit assignments. 


31 1 


0 


Figure 4-79 TLBTR bit assignments 


The following table shows the TLBTR bit assignments. 


Table 4-115 TLBTR bit assignments 


Name Function 





Reserved, RESO. 





Not Unified. Indicates whether the implementation has a unified TLB. The value is: 


Processor has a unified TLB. 





To access the TLBTR in AArch32 state, read the CP15 register with: 


MRC p15, ©, <Rt>, c@, c@, 3; Read TLB Type Register 


Multiprocessor Affinity Register 


The MPIDR characteristics are: 
Purpose 
Provides an additional core identification mechanism for scheduling purposes in a cluster. 


Usage constraints 
The accessibility to the MPIDR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 


- RO RO RO RO RO 





Configurations 
The MPIDR is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to the AArch64 MPIDR_EL1[31:0] register. 


Attributes 
See the register summary in Table 4-84 c0 register summary on page 4-215. 


The following figure shows the MPIDR bit assignments. 


31 30 29 25 24 23 16 15 8 7 2 


0 


LRes1 LMT CPU ID— 


Figure 4-80 MPIDR bit assignments 


The following table shows the MPIDR bit assignments. 
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Table 4-116 MPIDR bit assignments 
































Bits Name Function 
[31] - Reserved, RES1. 
[30] U Indicates a single processor system, as distinct from core 0 in a cluster. This value 
is: 
0 Processor is part of a multicore system. 
[29:25] - Reserved, RESO. 
[24] MT Indicates whether the lowest level of affinity consists of logical cores that are 
implemented using a multi-threading type approach: 
0 Performance of cores at the lowest affinity level is largely independent. 
1 Performance of cores at the lowest affinity level is very interdependent. 
[23:16] Cluster ID Aff2 Indicates the value read in at reset, from the CLUSTERIDAFF? configuration 
signal. It identifies a Cortex-A72 device in a system with more than one Cortex- 
A72 device present. 
[15:8] Cluster ID Affl Indicates the value read in at reset, from the CLUSTERIDAFF1 configuration 
signal. It identifies a Cortex-A72 device in a system with more than one Cortex- 
A72 device present. 
[7:2] - Reserved, RESO. 
[1:0] CPU ID Indicates the core number in the Cortex-A72 device. The possible values are: 
Qx® An MPCore device with one core only. 
0x0, 0x1 A Cortex-A72 device with two cores. 
0x0, 0x1, 0x2 A Cortex-A72 device with three cores. 
0x0, 0x1, 0x2, 0x3 A Cortex-A72 device with four cores. 
To access the MPIDR in AArch32 state, read the CP15 registers with: 
MRC p15, @, <Rt>, c@, c@, 5; Read Multiprocessor Affinity Register 
Related information 
4.3.2 Multiprocessor Affinity Register, ELI on page 4-90. 
4.5.4 Virtualization Multiprocessor ID Register 


The VMPIDR characteristics are: 


Purpose 


Holds the value of the Virtualization Multiprocessor ID. This is the value returned by Non- 
secure EL1 reads of MPIDR. . 


Usage constraints 


The accessibility to the VMPIDR in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 
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Configurations 
The VMPIDR is: 


¢ A Banked EL2 register. 
e Architecturally mapped to the AArch64 VMPIDR_EL2 register. 


Attributes 
See the register summary in Table 4-84 c0 register summary on page 4-215. 


The following figure shows the VMPIDR bit assignments. 


31 0 


VMPIDR 


Figure 4-81 VMPIDR bit assignments 
The following table shows the VMPIDR bit assignments. 


Table 4-117 VMPIDR bit assignments 





Bits Name Function 





[31:0] VMPIDR MPIDR value returned by Non-secure EL! reads of the MPIDR. For information on the subdivision of this value, 
see 4.5.3 Multiprocessor Affinity Register on page 4-240. 





To access the VMPIDR, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c@, c@, 5; Read Virtualization Multiprocessor ID Register 
MCR p15, 4, <Rt>, c@, c@, 5; Write Virtualization Multiprocessor ID Register 


Related information 
4.5.3 Multiprocessor Affinity Register on page 4-240. 
4.3.29 Virtualization Multiprocessor ID Register, EL2 on page 4-124. 


4.5.5 System Control Register 


The SCTLR characteristics are: 


Purpose 

Provides the top-level control of the system, including its memory system. 
Usage constraints 

The accessibility to the SCTLR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Control bits in the SCTLR that are not applicable to a VMSA implementation read as the value 
that most closely reflects that implementation, and ignore writes. 


Some bits in the register are read-only. These bits relate to non-configurable features of an 
implementation, and are provided for compatibility with other versions of the architecture. 


Write access to the Secure copy of SCTLR is disabled when the CPISSDISABLE signal is 
HIGH. 


Configurations 
The SCTLR is Banked for Secure and Non-secure states. 
The architectural mapping of the SCTLR is: 
e The Non-secure SCTLR is mapped to the AArch64 SCTLR_ELI. 
e The Secure SCTLR is mapped to the AArch64 SCTLR_EL3. 
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Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the SCTLR bit assignments. 
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Figure 4-82 SCTLR bit assignments 
The following table shows the SCTLR bit assignments. 


Table 4-118 SCTLR bit assignments 








Bits Name Access Function 
[31] - - Reserved, RESO. 
[30] TE Banked Thumb Exception enable. This bit controls whether 


exceptions are taken in ARM or Thumb state: 
0 Exceptions, including reset, taken in ARM state. 
1 Exceptions, including reset, taken in Thumb state. 


The primary input CFGTE defines the reset value of the TE 
bit of the Secure Banked register. 





[29] AFE Banked Access flag enable. This bit enables use of the AP[0] bit in 
the translation table descriptors as the Access flag. It also 
restricts access permissions in the translation table 
descriptors to the simplified model as described in the ARM* 
Architecture Reference Manual ARMvé. In the translation 
table descriptors, AP[0] is: 


0 An access permissions bit. The full range of access 
permissions is supported. No access flag is implemented. 
This is the reset value. 


1 The Access flag. Only the simplified model for access 
permissions is supported. 

When TTBCR.EAE is set to 1, to enable use of the Long- 

descriptor translation table format, this bit is UNK/RES1. 


This bit is permitted to be cached in a TLB. 
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Table 4-118 SCTLR bit assignments (continued) 





Bits 


[28] 


Name 


TRE 


Access 


Banked 


Function 


TEX remap enable. This bit enables remapping of the 
TEX[2:1] bits for use as two translation table bits that can be 
managed by the operating system. Enabling this remapping 
also changes the scheme that describes the memory region 
attributes in the VMSA. The possible values are: 


0 TEX remap disabled. TEX[2:0] are used, with the C and 
B bits, to describe the memory region attributes. This is 
the reset value. 


1 TEX remap enabled. TEX[2:1] are reassigned for use as 
bits managed by the operating system. The TEX[0], C 
and B bits describe the memory region attributes, with 
the MMU remap registers. 


When TTBCR.EAE is set to 1, to enable use of the Long- 
descriptor translation table format, this bit is UNK/RES1. 


This bit is permitted to be cached in a TLB. 





[27:26] 


Reserved, RESO. 





[25] 


EE 


Banked 


Exception Endianness. The value of this bit defines the value 
of the CPSR.E bit on entry to an exception vector, including 
reset. This value also indicates the endianness of the 
translation table data for translation table lookups. The values 
are: 


0 Little endian. 


1 Big endian. 


The primary input CFGEND defines the reset value of the 
EE bit of the Secure Banked register. 





[24] 


Reserved, RESO. 





[23:22] 


Reserved, RES1. 





[21] 


Reserved, RESO. 





[20] 


UWXN 


Banked 


Unprivileged write permission implies EL1 Execute Never 
(XN). You can use this bit to require all memory regions with 
unprivileged write permissions are treated as XN for accesses 
from software executing at EL1. Regions with unprivileged 
write permission are: 


0 Not forced to be XN. This is the reset value. 


1 Forced to be XN for accesses from software executing at 
ELI. 


This bit is permitted to be cached in a TLB. 
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Table 4-118 SCTLR bit assignments (continued) 






































Bits Name Access Function 

[19] WXN Banked Write permission implies Execute Never (XN). You can use 
this bit to require all memory regions with write permissions 
are treated as XN. Regions with write permission are: 

0 Not forced to be XN. This is the reset value. 

1 Forced to be XN. 

This bit is permitted to be cached in a TLB. 

[18] nTWE Banked WFE trap. The values are: 

0 A WFE instruction executed at ELO that causes suspended 
execution as if the event register is not set and there is no 
pending WFE wake-up event. It is treated as UNDEFINED. 

1 WFE instructions executed as normal. This is the reset 
value. 

[17] - - Reserved, RESO. 
[16] nTWI Banked WFI trap. The values are: 

0 A WFI instruction executed at ELO that causes suspended 
execution as if there is not a pending WFI wake-up 
event. It is treated as UNDEFINED. 

1 WFE instructions executed as normal. This is the reset 
value. 

[15:14] - - Reserved, RESO. 
[13] V Banked Vectors bit. This bit selects the base address of the exception 
vectors: 

0 Normal exception vectors, base address @x00000000. 
This base address can be remapped. 

1 High exception vectors, base address @xFFFFQQ@@. This 
base address is never remapped. 

The primary input VINITHI defines the reset value of the V 

bit of the Secure Banked register. 

[12] I Banked Instruction Cache enable. This is a global enable bit for 

Instruction Caches: 

0 Instruction Caches disabled. This is the reset value. 

1 Instruction Caches enabled. 

[11] - - Reserved, RES1. 
[10:9] - - Reserved, RESO. 
[8] SED Banked SETEND instruction disable. The values are: 

0 SETEND instruction is enabled. This is the reset value. 

1 SETEND instruction is UNALLOCATED. 
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Table 4-118 SCTLR bit assignments (continued) 





Bits Name Access Function 





[7] ITD Banked IT instruction disable. The values are: 


0 IT instruction functionality is enabled. This is the reset 
value. 

1 All encodings of the IT instruction are UNDEFINED when 
either: 
e hw[3:0] are not equal to 0b1000. 
¢ IT instructions with a subsequent 32-bit instruction. 
« Subsequent PC reading or writing instruction. 





[6] THEE Banked ThumbFE enable. This value is: 


0  ThumbFE is not implemented. 





[5] CPISBEN Banked AArch32 CP15 barrier enable. The values are: 


0 CP15 barrier operations disabled. Their encodings are 
UNDEFINED. 


1 CP15 barrier operations enabled. This is the reset value. 








[4:3] - - Reserved, RES1. 
[2] C Banked Cache enable. This is a global enable bit for data and unified 
caches: 


0 Data and unified caches disabled. This is the reset value. 


1 Data and unified caches enabled. 





[1] A Banked Alignment check enable. This is the enable bit for Alignment 
fault checking: 


0 Alignment fault checking disabled. This is the reset 
value. 


1 Alignment fault checking enabled. 





[0] M Banked MMU enable. This is a global enable bit for the EL1 and ELO 
stage 1 MMU: 


0 ELI and ELO stage 1 MMU disabled. This is the reset 
value. 


1 EL! and ELO stage 1 MMU enabled. 





To access the SCTLR in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c1, c@, @; Read System Control Register 
MCR p15, ©, <Rt>, c1, c0, @; Write System Control Register 


To access the SCTLR_EL1 in AArch64 state, read or write the register with: 


MRS <Xt>, SCTLR_EL1; Read System Control Register 
MSR SCTLR_EL1, <Xt>; Write System Control Register 


To access the SCTLR_EL3 in AArch64 state, read or write the register with: 


MRS <Xt>, SCTLR_EL3; Read System Control Register 
MSR SCTLR_EL3, <Xt>; Write System Control Register 
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Related information 
4.3.30 System Control Register, EL] on page 4-125. 
4.3.38 System Control Register, EL3 on page 4-141. 


4.5.6 Architectural Feature Access Control Register 


The CPACR characteristics are: 


Purpose 
Controls access to the CP10 and CP11 coprocessors. It also enables software to check for the 
presence of coprocessors CP10 to CP11. 

Usage constraints 
The accessibility to the CPACR by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 


- RW RW RW RW RW 





The CPACR has no effect on instructions executed in Hyp mode. 


Configurations 
The CPACR is: 
e Common to the Secure and Non-secure states. 
e Architecturally mapped to the AArch64 CPACR_ELI register. 





Note 
The NSACR controls Non-secure access to the CPACR fields. 





Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the CPACR bit assignments. 
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Figure 4-83 CPACR bit assignments 
The following table shows the CPACR bit assignments. 


Table 4-119 CPACR bit assignments 





Bits Name Function 





[31] ASEDIS Disables Advanced SIMD functionality: 
0 All Advanced SIMD and FP instructions execute normally. This is the reset value. 


1 All instruction encodings that are part of Advanced SIMD, but not FP instructions, are UNDEFINED. 





[30:29] - Reserved, RESO. 





[28] TRCDIS Disable CP14 access to trace registers: 


0 CP14 access to trace registers is not supported. This bit is RESO. 





[27:24] - Reserved, RESO. 
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Table 4-119 CPACR bit assignments (continued) 





Bits Name Function 





[23:22] cpll Defines the access rights for coprocessor 11. The values are: 
@bee@ Access denied. Any attempt to access the coprocessor generates an Undefined Instruction exception. This 
is the reset value. 


@be@1 Access at EL1 or higher only. Any attempt to access the coprocessor from software executing at ELO 
generates an Undefined Instruction exception. 


@b10 Reserved. 


@b11 Full access. The meaning of full access is defined by the appropriate coprocessor. 


If NSACR[11:10] is @60@ in Non-secure state, these bits are RESO. 





[21:20] cp10 Defines the access rights for coprocessor 10. The values are: 
@bee@ Access denied. Any attempt to access the coprocessor generates an Undefined Instruction exception. This 
is the reset value. 


@be@1 Access at EL1 or higher only. Any attempt to access the coprocessor from software executing at ELO 
generates an Undefined Instruction exception. 


@b10 Reserved. 


@b11 Full access. The meaning of full access is defined by the appropriate coprocessor. 


If NSACR[11:10] is @60@ in Non-secure state, these bits are RESO. 





[19:0] - Reserved, RESO. 





Note 


If the values of the cp11 and cp10 fields are not the same, the behavior is same as if both fields were set 
to the value of cp10, in all respects other than the value read back by explicitly reading cp11. 








To access the CPACR in AArch32 state, read or write the CP15 register with: 


MRC p15, @, <Rt>, c1, c@, 2; Read Architectural Feature Access Control Register 
MCR p15, ©, <Rt>, c1, c@, 2; Write Architectural Feature Access Control Register 


Related information 
4.3.32 Architectural Feature Access Control Register, ELI on page 4-129. 
4.5.8 Non-secure Access Control Register on page 4-251. 


4.5.7 Secure Configuration Register 


The SCR characteristics are: 


Purpose Defines the configuration of the current Security state. It specifies: 


¢ The Security state of the processor, Secure or Non-secure. 
e What mode the processor branches to, if an IRQ, FIQ, or external abort occurs. 
e Whether the CPSR.F and CPSR.A bits can be modified when SCR.NS is 1. 


If EL3 is using AArch64, accesses to this register from Secure EL1 using AArch32 
are trapped to EL3. 
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Usage The accessibility to the SCR by Exception level is: 
constraints 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - TRAP - RW RW 





Configurations The SCR is a Restricted access register that exists only in the Secure state. 
The SCR is mapped to the AArch64 SCR_EL3 register. 


Attributes See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the SCR bit assignments. 
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Figure 4-84 SCR bit assignments 


The following table shows the SCR bit assignments. 


Table 4-120 SCR bit assignments 











Bits Name Function 
[31:14] - Reserved, RESO. 
[13] TWE Trap WFE instructions. The possible values are: 


0 WFE instructions are not trapped. This is the reset value. 


1 WFE instructions executed in any mode other than Monitor mode that 
would cause suspended execution as if the event register is not set, there 
is not a pending WFE wake-up event and the instruction does not cause 
another exception, is trapped to Monitor mode using the UNDEFINED 
exception vector. 





[12] TWI Trap WFI instructions. The possible values are: 


0 WFI instructions are not trapped. This is the reset value. 


1 WFI instructions executed in any mode other than Monitor mode that 
would cause suspended execution, as if there is no pending WFI wake- 
up event and the instruction does not cause another exception, is trapped 
to Monitor mode using the UNDEFINED exception vector. 








[11:10] - Reserved, RESO. 

[9] SIF Secure Instruction Fetch. When the processor is in Secure state, this bit 
disables instruction fetches from Non-secure memory. The possible values 
are: 


0 Secure state instruction fetches from Non-secure memory permitted. 
This is the reset value. 


1 Secure state instruction fetches from Non-secure memory not permitted. 
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Table 4-120 SCR bit assignments (continued) 





Bits 
[8] 


Name 


HCE 


Function 
Hyp Call enable. This bit enables the use of HVC instruction. The possible 


values are: 


0 The HVC instruction is UNDEFINED in any mode. This is the reset value. 


1 The HVC instruction enabled in Non-secure EL1 or EL2, and performs a 
Hyp Call. 





SCD 


Secure Monitor Call disable. This bit causes the SMC instruction to be 
UNDEFINED in all privileged modes. The possible values are: 


0 The SMC instruction executes normally from privileged modes, and 
performs a Secure Monitor Call. This is the reset value. 


1 The SMC instruction is UNDEFINED in any mode. 


A trap of the SMC instruction to Hyp mode from Non-secure EL1 takes 
priority over the value of this bit. See the ARM® Architecture Reference 
Manual ARMV8 for more information. 





nET 


Not Early Termination. This bit disables early termination. 


This bit is not implemented, RESO. 





AW 


A bit writable. This bit controls whether CPSR.A can be modified in Non- 

secure state. For the Cortex-A72 processor: 

e This bit has no effect on whether CPSR.A can be modified in Non- 
secure state. The AW bit can be modified in either Security state. 

¢ This bit, with the HCR.AMO bit, determines whether CPSR.A has any 
effect on exceptions that are routed to a Non-secure mode. 





[4] 


FW 


F bit writable. This bit controls whether CPSR.F can be modified in Non- 

secure state. For the Cortex-A72 processor: 

e This bit has no effect on whether CPSR.F can be modified in Non- 
secure state. The FW bit can be modified in either Security state. 

e This bit, with the HCR.FMO bit, determines whether CPSR.F has any 
effect on exceptions that are routed to a Non-secure mode. 





EA 


External Abort handler. This bit controls which mode takes external aborts. 
The possible values are: 


0 External aborts taken in Abort mode. This is the reset value. 


1 External aborts taken in Monitor mode. 





[2] 


FIQ 


FIQ handler. This bit controls which mode takes FIQ exceptions. The 
possible values are: 


0 FIQs taken in FIQ mode. This is the reset value. 
1 FIQs taken in Monitor mode. 
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Table 4-120 SCR bit assignments (continued) 





Bits Name Function 





[1] IRQ IRQ handler. This bit controls which mode takes IRQ exceptions. The 
possible values are: 


0 IRQs taken in IRQ mode. This is the reset value. 
1 IRQs taken in Monitor mode. 





[0] NS Non-secure bit. Except when the processor is in Monitor mode, this bit 
determines the Security state of the processor. The possible values are: 


0 Secure. This is the reset value. 


1 Non-secure. 


Note 


When the processor is in Monitor mode, it is always in Secure state, 
regardless of the value of the NS bit. 











To access the SCR in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c1, c1, @; Read Secure Configuration Register data 
MCR p15, ©, <Rt>, c1, c1, @; Write Secure Configuration Register data 


4.5.8 Non-secure Access Control Register 


The NSACR characteristics are: 


Purpose 
Defines the Non-secure access permission to the CP10 and CP11 coprocessors and controls 
Non-secure Advanced SIMD functionality. 

Usage constraints 
The accessibility to the NSACR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RO TRAP RO RO RW 





If EL3 is using AArch64, accesses to this register from Secure EL1 using AArch32 are trapped 
to EL3. 


Configurations 
The NSACR: 
e Isa Restricted access register that exists only in the Secure state but can be read from the 


Non-secure state. 
e Functionality is replaced by the behavior in the CPTR_EL3 register in AArch64 state. 


When EL3 is using AArch64, reads of the NSACR from Non-secure EL2 or Non-secure EL 1 
using AArch32, return a fixed value of @xeee00Ccee. 


Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the NSACR bit assignments. 
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Figure 4-85 NSACR bit assignments 
The following table shows the NSACR bit assignments. 


Table 4-121 NSACR bit assignments 





Bits Name Function 





[31:21] - Reserved, RESO. 





[20] NSTRCDIS Disable Non-secure access to CP 14 trace registers: 


0 CP14 access to trace registers is not supported. This bit is RESO. 





[19:16] - Reserved, RESO. 





[15] NSASEDIS Disables Non-secure Advanced SIMD functionality. The values are: 
0 This bit has no effect on the ability to write to the CAPCR.ASEDIS bit. This is the reset value. 
1 When executing in Non-secure state, the CPACR.ASEDIS bit is RES1. 





[14:12] - Reserved, RESO. 





[11] cpll Non-secure access to coprocessor 11 enable. The values are: 


0 Secure access only. Any attempt to access coprocessor 11 in Non-secure state results in an Undefined 
Instruction exception. If the processor is in Non-secure state, the corresponding bits in the CPACR ignore 
writes and read as @b@Q, access denied. This is the reset value. 


1 Access from any Security state. 





[10] cpl0 Non-secure access to coprocessor 10 enable. The values are: 


0 Secure access only. Any attempt to access coprocessor 10 in Non-secure state results in an Undefined 
Instruction exception. If the processor is in Non-secure state, the corresponding bits in the CPACR ignore 
writes and read as @b@Q, access denied. This is the reset value. 


1 Access from any Security state. 





[9:0] - Reserved, RESO. 





To access the NSACR in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c1, c1, 2; Read Non-secure Access Control Register data 
MCR p15, ©, <Rt>, c1, c1, 2; Write Non-secure Access Control Register data 


Related information 
4.3.40 Architectural Feature Trap Register, EL3 on page 4-145. 


4.5.9 Secure Debug Configuration Register 


The SDCR characteristics are: 
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Purpose 
Controls the trapping to Hyp mode of Secure accesses, at EL1 or lower, to functions provided by 
the debug and trace architectures. 


If EL3 is using AArch64, accesses to this register from Secure EL1 using AArch32 are trapped 
to EL3. 


Usage constraints 
The accessibility to the SDCR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- - TRAP - RW RW 





Configurations 
The SDCR is a Restricted access register that only exists in the Secure state. 


The SDCR is mapped to the AArch64 MDCR_EL3 register. 


Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the SDCR bit assignments. 


31 22 21 20 19 18 17 16 15 14 13 0 


EPMAD— LeEpDAD | Lreso 
SPME 


Figure 4-86 SDCR bit assignments 


The following table shows the SDCR bit assignments 


Table 4-122 SDCR bit assignments 





Bits 


Name 


Function 





[31:22] - 


Reserved, RESO. 





[21] 


EPMAD 


Disables access to the performance monitor configuration registers by an external debugger: 


0 External debugger access to the performance monitor configuration registers enabled. This is the reset value. 


1 External debugger access to the performance monitor configuration registers disabled, unless overridden by the 
authentication interface. 


Resets to 0 on Warm reset. 





[20] 


EDAD 


Disables access to the breakpoint and watchpoint registers by an external debugger: 


0 External debugger access to the breakpoint and watchpoint registers enabled. This is the reset value. 


1 External debugger access to the breakpoint and watchpoint registers disabled, unless overridden by the 
authentication interface. 


Resets to 0 on Warm reset. 





[19:18] - 


Reserved, RESO. 





[17] 


SPME 


Enables Secure performance monitor: 


0 Performance monitors disabled in Secure state, no events are counted. This is the reset value. 


1 Performance monitors enabled in Secure state. 


Resets to 0 on Warm reset. 
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Table 4-122 SDCR bit assignments (continued) 





Bits Name Function 





[16] - Reserved, RESO. 





[15:14] SPD¢™ AArch32 Secure privileged debug. Enables or disables debug exceptions from Secure state if Secure EL1 is using 
AArch32, other than Software breakpoint instructions. The possible values are: 


@bee@ Legacy mode. Debug exceptions from Secure EL1 are enabled if 
AArch32SelfHostedSecurePrivilegedInvasiveDebugEnabled( ) is true. 


@b1@ Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 
@b11 Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled. 


The value @b@11 is reserved. 
Note 


If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure ELO are also enabled. 
Otherwise, debug exceptions from Secure ELO are enabled only if SDER32_EL3.SUIDEN is 1. 





Ignored if Secure EL1 is using AArch64 and in Non-secure state. Debug exceptions from Software breakpoint 
instruction debug events are always enabled. 





Resets to 0 on Warm reset. 





[13:0] - Reserved, RESO. 





To access the SDCR in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c1, c3, 1; Read Secure Debug Configuration Register 
MCR p15, @, <Rt>, c1, c3, 1; Write Secure Debug Configuration Register 


4.5.10 Hyp Configuration Register 


The HCR characteristics are: 


Purpose Provides configuration controls for virtualization, including defining whether various 
Non-secure operations are trapped to Hyp mode. 

Usage The accessibility to the HCR in AArch32 state by Exception level is: 

constraints 


ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations The HCR is: 


e A Banked EL2 register 
e Architecturally mapped to the AArch64 HCR_EL2[31:0] register. 


Attributes See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the HCR bit assignments. 





dm spp only applies in Secure state and when either Secure EL1 or EL3 is using AArch32. 
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Figure 4-87 HCR bit assignments 


The following table shows the HCR bit assignments. 


Table 4-123 HCR bit assignments 





Bits Name 


Function 





[31] - 


Reserved, RESO. 





[30] TRVM 


Trap Read of Virtual Memory controls. When 1, this causes reads to the 
EL1 virtual memory control registers from EL1 to be trapped to EL2. 
This covers the following registers: 


AArch32 SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, 
DFAR, IFAR, ADFSR, AIFSR, PRRR/MAIRO, NMRR/ 
MAIRI, AMAIRO, AMAIRI, and CONTEXTIDR. 


The reset value is 0. 





Reserved, RESO. 





[27] TGE 


Trap general exceptions. When this bit is set to 1, and the processor is 
executing at ELO in Non-secure state, Undefined Instruction exceptions, 
Supervisor Call exceptions, synchronous External aborts and some 
Alignment faults are taken in Hyp mode. 


The SCTLR.M bit is treated as being 0 regardless of its actual state, 
other than for the purpose of reading the bit. 


When the processor is executing at EL1 in Non-secure state, and this bit 
is set to 1, the Illegal Exception Return mechanism is invoked. 


The reset value is 0. 





[26] TVM 


Trap Virtual Memory controls. When 1, this causes writes to the EL1 
virtual memory control registers from EL1 to be trapped to EL2. This 
covers the following registers: 


AArch32 SCTLR, TTBRO, TTBR1, TTBCR, DACR, DFSR, IFSR, 
DFAR, IFAR, ADFSR, AIFSR, PRRR/MAIRO, NMRR/ 
MAIRI, AMAIRO, AMAIRI, and CONTEXTIDR. 


The reset value is 0. 








ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 4-255 


Non-Confidential 


4 System Control 
4.5 AArch32 register descriptions 


Table 4-123 HCR bit assignments (continued) 





Bits 


[25] 


Name 


TTLB 


Function 


Trap TLB maintenance instructions. When 1, this causes TLB 
maintenance instructions executed from EL1 that are not UNDEFINED to 
be trapped to EL2. This covers the following instructions: 


AArch32  TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, 
ITLBIALL, DTLBIALL, TLBIALL, ITLBIMVA, DTLBIMVA, 
TLBIMVA, ITLBIASID, DTLBIASID, TLBIASID, 
TLBIMVAA, TLBIMVALIS, TLBIMVAALIS, TLBIMVAL, and 
TLBIMVAAL. 


The reset value is 0. 





[24] 


TPU 


Trap Cache maintenance instructions to Point of Unification. When 1, 
this causes Cache maintenance instructions to the point of unification 
executed from EL1 or ELO that are not UNDEFINED to be trapped to EL2. 
This covers the following instructions: 


AArch32 ICIMVAU, ICIALLU, ICIALLUTIS, and DCCMVAU. 


The reset value is 0. 





[23] 


TPC 


Trap Data/Unified Cache maintenance operations to Point of Coherency. 
When 1, this causes Data or Unified Cache maintenance instructions by 
address to the point of coherency executed from EL1 or ELO that are not 
UNDEFINED to be trapped to EL2. This covers the following instructions: 


AArch32 DCIMVAC, DCCIMVAC, and DCCMVAC. 


The reset value is 0. 





[22] 


TSW 


Trap Data/Unified Cache maintenance operations by Set/Way. When 1, 
this causes Data or Unified Cache maintenance instructions by set/way 
executed from EL1 that are not UNDEFINED to be trapped to EL2. This 
covers the following instructions: 


AArch32 DCISW, DCCSW, and DCCISW. 


The reset value is 0. 





[21] 


TAC 


Trap ACTLR accesses. When this bit is set to 1, any valid Non-secure 
access to the ACTLR is trapped to Hyp mode. 


The reset value is 0. 





[20] 


TIDCP 


Trap Implementation Dependent functionality. When 1, this causes 
accesses to the following instruction set space executed from EL1 to be 
trapped to EL2: 


AArch32 All CP15 MCR and MRC instructions as follows: 
e CRnis 9, opl is 0-7, CRm is c0, c1, c2, c5, c6, c7, or 
c8, and op2 is 0-7. 
e CRnis 10, opl is 0-7, CRm is c0, cl, c4, or c8, and op2 
is 0-7. 
e CRnis 11, opl is 0-7, CRm is c0 to c8, or c15, and op2 
is 0-7. 


The reset value is 0. 
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Table 4-123 HCR bit assignments (continued) 





Bits 
[19] 


Name 


TSC 


Function 


Trap SMC instruction. When this bit is set to 1, any attempt from Non- 
secure EL1 to execute an SMC instruction, that passes its condition check 
if it is conditional, is trapped to Hyp mode. 


The reset value is 0. 





[18] 


TID3 


Trap ID Group 3. When 1, this causes reads to the following registers 
executed from EL1 to be trapped to EL2: 


AArch32 ID_PFRO, ID_PFR1, ID_DFRO, ID_AFRO, ID_ MMFRO, 
ID_MMFRI1, ID_MMFR2, ID _MMFR3, ID_ISARO, 
ID_ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, ID_ISARS, 
MVFRO, MVFR1, and MVFR2 and MRC instructions to the 
following locations: 

e opl is 0, CRn is 0, CRm is c3, c4, c5, c6, or c7, and op2 
isOorl. 

e opl is 0, CRn is 0, CRm is c3, and op2 is 2. 

* opl is 0, CRn is 0, CRm is 5, and op2 is 4 or 5. 


The reset value is 0. 





[17] 


TID2 


Trap ID Group 2. When 1, this causes reads (or writes to CSSELR/ 
CSSELR_EL1) to the following registers executed from EL1 or ELO if 
not UNDEFINED to be trapped to EL2: 


AArch32 CTR, CCSIDR, CLIDR, and CSSELR. 


The reset value is 0. 





[16] 


TID1 


Trap ID Group 1. When 1, this causes reads to the following registers 
executed from EL1 to be trapped to EL2: 


AArch32 TCMTR, TLBTR, AIDR, and REVIDR. 


The reset value is 0. 





TIDO 


Trap ID Group 0. When 1, this causes reads to the following registers 
executed from EL1 or ELO if not UNDEFINED to be trapped to EL2: 


AArch32 FPSID and JIDR. 


The reset value is 0. 





[14] 


TWE 


Traps WFE instruction if it would cause suspension of execution. For 
example, if there is no pending WFE event: 


0 WFE instruction is not trapped. This is the reset value. 


1 WFE instruction executed in Non-secure EL1 or ELO is trapped to 
EL2. 





[13] 


TWI 


Traps WFI instruction if it would cause suspension of execution. For 
example, if there is no pending WFI event: 


0 WFI instruction is not trapped. This is the reset value. 


1 WFI instruction executed in Non-secure EL1 or ELO is trapped to 
EL2. 
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Table 4-123 HCR bit assignments (continued) 





Bits Name 


[12] DC 


Function 


Default Cacheable. When this bit is set to 1 the memory type and 
attributes determined by the stage 1 translation is Normal, Non- 
shareable, Inner Write-Back Write-Allocate, Outer Write-Back Write- 
Allocate. 
When executing in a Non-secure mode other than Hyp mode and the 
HCR.DC bit is set, the processor behavior is consistent with the 
behavior when: 
e The SCTLR.M bit is clear, regardless of the actual value of the 
SCTLR.M bit. 
— Anexplicit read of the SCTLR.M bit returns its actual value. 
e The HCR.VM bit is set, regardless of the actual value of the 
HCR.VM bit. 
— Anexplicit read of the HCR.VM bit returns its actual value. 


The reset value is 0. 





[11:10] BSU 


Barrier Shareability upgrade. The value in this field determines the 
minimum shareability domain that is applied to any barrier executed 
from EL1 or ELO. The values are: 

e@bee No effect. 

@be1 Inner Shareable. 

@b10 Outer Shareable. 

@b11 Full System. 


The reset value is 0. 





Force broadcast. When 1, this causes the following instructions to be 
broadcast within the Inner Shareable domain when executed from Non- 
secure ELI: 


AArch32 ITLBIALL, DTLBIALL, TLBIALL, ITLBIMVA, DTLBIMVA, 
TLBIMVA, ITLBIASID, DTLBIASID, TLBIASID, 
TLBIMVAA, BPIALL, and ICIALLU. 


The reset value is 0. 





[8] VA 


Virtual Asynchronous Abort exception. Setting this bit signals a virtual 
Asynchronous Abort exception to the Guest OS, when the AMO bit is 
set to 1 and the processor is executing in Non-secure state at ELO or 
ELI. 


The Guest OS cannot distinguish the virtual exception from the 
corresponding physical exception. 


The reset value is 0. 





Virtual IRQ exception. Setting this bit signals a virtual IRQ exception to 
the Guest OS, when the IMO bit is set to 1 and the processor is 
executing in Non-secure state at ELO or EL1. 


The Guest OS cannot distinguish the virtual exception from the 
corresponding physical exception. 


The reset value is 0. 
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Table 4-123 HCR bit assignments (continued) 





























Bits Name Function 

[6] VF Virtual FIQ exception. Setting this bit signals a virtual FIQ exception to 
the Guest OS, when the FMO bit is set to 1 and the processor is 
executing in Non-secure state at ELO or EL1. 

The Guest OS cannot distinguish the virtual exception from the 
corresponding physical exception. 
The reset value is 0. 

[5] AMO Asynchronous Abort Mask Override. When this bit is set to 1, it 
overrides the effect of CPSR.A, and enables virtual exception signaling 
by the VA bit. 

The reset value is 0. 

[4] IMO IRQ Mask Override. When this bit is set to 1, it overrides the effect of 
CPSR.I, and enables virtual exception signaling by the VI bit. 

The reset value is 0. 

[3] FMO FIQ Mask Override. When this bit is set to 1, it overrides the effect of 
CPSR.F, and enables virtual exception signaling by the VF bit. 

The reset value is 0. 

[2] PTW Protected Table Walk. When 1, if the stage 2 translation of a translation 
table access made as part of a stage 1 translation table walk at Non- 
secure ELO or EL1 maps that translation table access to Device memory, 
the access is faulted as a stage 2 Permission fault. 

The reset value is 0. 

[1] SWIO Set/Way Invalidation Override. When 1, this causes EL1 execution of 
the Data Cache Invalidate by Set/Way instruction to be treated as Data 
Cache Clean and Invalidate by Set/Way. The affected instructions are: 
AArch32 DCISW is executed as DCCISW. 

The reset value is 0. 

[0] VM Second stage of Translation enable. When 1, this enables the second 
stage of translation for execution in EL1 and ELO. This bit is permitted 
to be cached in a TLB. 

The reset value is 0. 
To access the HCR in AArch32 state, read or write the CP15 register with: 
MRC p15, 4, <Rt>, c1, c1, @; Read Hyp Configuration Register 
MCR p15, 4, <Rt>, c1, c1, @; Write Hyp Configuration Register 
Related information 
4.3.34 Hypervisor Configuration Register, EL2 on page 4-131. 
4.5.11 Hyp Configuration Register 2 


The HCR2 characteristics are: 
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Purpose 
Provides additional configuration controls for virtualization. 
Usage constraints 
The accessibility to the HCR2 in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations 
The HCR2 is: 


e A Banked EL2 register. 
e Architecturally mapped to the AArch64 HCR_EL2[63:31] register. 


Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the HCR2 bit assignments. 


31 210 
mm 
LCD 


Figure 4-88 HCR2 bit assignments 


The following table shows the HCR2 bit assignments. 


Table 4-124 HCR2 bit assignments 





Bits Name Function 





[31:2] - Reserved, RESO. 





[1] ID Stage 2 Instruction Cache disable. When HCR_EL2.VM is 1, this forces all stage2 translations for instruction accesses 
to Normal memory to be Non-cacheable for the EL1/ELO translation regime. The values are: 


0 No effect on the stage 2 of the EL1/EL0 translation regime for instruction accesses. This is the reset value. 


1 Forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable for the EL0/EL1 
translation regime. 





[0] CD Stage 2 Data cache disable. When HCR_EL2.VM is 1, this forces all stage2 translations for data accesses and 
translation table walks to Normal memory to be Non-cacheable for the EL1/EL0 translation regime. The values are: 


0 No effect on the stage 2 of the EL1/EL0 translation regime for data accesses and translation table walks. This is 
the reset value. 


1 Forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non- 
cacheable for the ELO/EL1 translation regime. 





To access the HCR2 in AArch32 state, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c1, c1, 4; Read Hyp Configuration Register 2 
MCR p15, 4, <Rt>, c1, c1, 4; Write Configuration Register 2 


Related information 
4.3.34 Hypervisor Configuration Register, EL2 on page 4-131. 
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4.5.12 Hyp Debug Control Register 


The HDCR characteristics are: 


Purpose 
Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to functions 
provided by the debug and trace architectures. 

Usage constraints 
The accessibility to the HDCR in AArch32 state by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations 
The HDCR is: 
e A Banked EL? register. 
e Architecturally mapped to the AArch64 MDCR_EL2 register. 


Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the HDCR bit assignments. 
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Figure 4-89 HDCR bit assignments 
The following table shows the HDCR bit assignments. 


Table 4-125 HDCR bit assignments 





Bits Name Function 





[31:12] - Reserved, RESO. 





[11] TDRA Trap Debug ROM Access. The values are: 
0 Has no effect on Debug ROM accesses. This is the reset value. 
1 Trap valid Non-secure ELO or EL1 Debug ROM accesses to Hyp mode. 
When this bit is set to 1, any valid Non-secure access to DBGDRAR or DBGDSAR is trapped to Hyp mode. 


If bit[8], TDE, is set, or if the HCR.TGE bit is set, the TDRA value is ignored and the processor behaves as if this 
bit is set to 1. 
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Table 4-125 HDCR bit assignments (continued) 





Bits Name Function 


[10] TDOSA Trap Debug OS-related register Access. The values are: 


0 Has no effect on accesses to CP14 Debug registers. This is the reset value. 


1 Trap valid ELO or EL1 Non-secure accesses to CP14 OS-related Debug registers to Hyp mode. 


When this bit is set to 1, any valid Non-secure CP14 access to the following OS-related Debug registers is trapped 


to Hyp mode: 

* DBGOSLSR. 
e DBGOSLAR. 
e DBGOSDLR. 
e DBGPRCR. 


If bit[8], TDE, is set, or if the HCR.TGE bit is set, the TDRA value is ignored and the processor behaves as if this 
bit is set to 1. 





[9] TDA Trap Debug Access. The values are: 
0 Has no effect on accesses to CP14 Debug registers. This is the reset value. 


1 Trap valid ELO or EL1 Non-secure accesses to CP14 Debug registers to Hyp mode. 


When this bit is set to 1, any valid Non-secure access to the CP14 Debug registers, other than the registers trapped 
by the TDRA and TDOSA bits, is trapped to Hyp mode. 


If bit[8], TDE, is set, or if the HCR.TGE bit is set, the TDRA value is ignored and the processor behaves as if this 
bit is set to 1. 





[8] TDE Trap Debug Exceptions. The values are: 


0 Has no effect on Debug exceptions. This is the reset value. 


1 Trap valid Non-secure Debug exceptions to Hyp mode. 


When this bit is set to 1, any Debug exception taken in Non-secure state is trapped to Hyp mode. 


When this bit is set to 1, the TRA, TDOSA, and TDA bits are treated as if they are set to 1, irrespective of the value 
stored in the register. If the HCR.TGE bit is set to 1, this bit is treated as if it was set to 1, irrespective of the value 
stored in the register. 





[7] HPME  Hypervisor Performance Monitors Enable. The values are: 


0 Hyp mode Performance Monitors counters disabled. This is the reset value. 


1 Hyp mode Performance Monitors counters enabled. 


When this bit is set to 1, access to the Performance Monitors counters that are reserved for use from Hyp mode is 
enabled. For more information, see the description of the HPMN field. 





[6] TPM Trap Performance Monitors accesses. The values are: 
0 Has no effect on Performance Monitors accesses. This is the reset value. 


1 Trap valid Non-secure Performance Monitors accesses to Hyp mode. 


When this bit is set to 1, any valid Non-secure ELO or EL1 access to the Performance Monitors registers is trapped 
to Hyp mode. 
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Table 4-125 HDCR bit assignments (continued) 





Bits Name Function 





[5] TPMCR Trap Performance Monitors Control Register accesses. The values are: 


0 Has no effect on PMCR accesses. This is the reset value. 


1 Trap valid Non-secure PMCR accesses to Hyp mode. 


When this bit is set to 1, any valid Non-secure access to the PMCR is trapped to Hyp mode. 





[4:0]  HPMN Defines the number of Performance Monitors counters that are accessible from Non-secure EL1, and from Non- 
secure ELO if unprivileged access is enabled. 


This field behaves as if it contains an UNKNOWN value of less than or equal to PMCR.N, in all ways other than 
when reading back this field if: 


¢ This field is set to 0. 
¢ This field is set to a value greater than PMCR.N. 


In Non-secure state, HPMN divides the Performance Monitors counters as follows: 


If PMXEVCNTR is accessing Performance Monitors counter n then, in Non-secure state: 

e Ifnis inthe range 0 < n < HPMN, the counter is accessible from EL1 and EL2, and from ELO if unprivileged 
access to the counters is enabled. 

e Ifnis inthe range HPMN <n < PMCR.N, the counter is accessible only from EL2. The HPME bit enables 
access to the counters in this range. 





This field resets to @x6, the value of PMCR.N. 





To access the HDCR in AArch32 state, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c1, c1, 1; Read Hyp Debug Configuration Register 
MCR p15, 4, <Rt>, c1, c1, 1; Write Hyp Debug Configuration Register 


To access the MDCR_EL2 in AArch64 state, read or write the register with: 


MRS <Xt>, MDCR_EL2; Read Monitor Debug Configuration Register 
MSR MDCR_EL2, <Xt>; Write Monitor Debug Configuration Register 


4.5.13 Hyp Architectural Feature Trap Register 


The HCPTR characteristics are: 


Purpose 
Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to coprocessors 
other than CP14 and CP15 and to floating-point and Advanced SIMD functionality. The HCPTR 
also controls the access to this functionality from Hyp mode. 

Usage constraints 
The accessibility to the HCPTR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 





If a bit in the NSACR prohibits a Non-secure access, then the corresponding bit in the HCPTR 
behaves as RES! for Non-secure accesses. See the bit descriptions for more information. 


Configurations 
The HCPTR is: 
¢ A Banked EL2 register. 
e Architecturally mapped to the AArch64 CPTR_EL2 register. 
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Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


The following figure shows the HCPTR bit assignments. 


31 30 21 20 19 16.15 14 13 12.11 10 9 0 
L- TCPAC LTTA LResO LTCP10 
TASE TCP11 


Figure 4-90 HCPTR bit assignments 
The following table shows the HCPTR bit assignments. 


Table 4-126 HCPTR bit assignments 





Bits Name Function 


[31] TCPAC Trap Coprocessor Access Control Register accesses. When this bit is set to 1, any valid Non-secure EL1 accesses to 
the CPACR is trapped to Hyp mode. The values are: 


0 Has no effect on CPACR accesses. This is the reset value. 


1 ‘Trap valid Non-secure EL1 CPACR accesses to Hyp mode. 





[30:21] - Reserved, UNK/RESO. 





[20] TTA Trap Trace Access. This value is: 


0 CP 14 access to the trace registers is not supported. 





[19:16] - Reserved, UNK/RESO. 





[15] TASE Trap Advanced SIMD use. If NSACR.NSASEDIS is set to 1, this bit behaves as RES1 on Non-secure accesses. The 
values are: 


0 Ifthe NSACR settings permit Non-secure use of the Advanced SIMD functionality then Hyp mode can access 
that functionality, regardless of any settings in the CPACR. This is the reset value. 
Note 


This bit value has no effect on possible use of the Advanced SIMD functionality from Non-secure EL1 and 
ELO. 








1 Trap valid Non-secure accesses to Advanced SIMD functionality to Hyp mode. 
When this bit is set to 1, any otherwise-valid access to Advanced SIMD functionality from: 
° A Non-secure EL1 or ELO access is trapped to Hyp mode. 
¢ Hyp mode generates an UNDEFINED Instruction exception, taken in Hyp mode. 




















Note 
If TCP10 and TCP11 are set to 1, then all Advanced SIMD use is trapped to Hyp mode, regardless of the value of 
this field. 
[14] - Reserved, RESO. 
[13:12] - Reserved, RES1. 
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Table 4-126 HCPTR bit assignments (continued) 





Bits Name Function 





[11] TCP11 Trap coprocessor 11. The values are: 
0 IfNSACR.CP11 is set to 1, then Hyp mode can access CP11, regardless of the value of CPACR.CP11. This is 


the reset value. 
Note 
This bit value has no effect on possible use of CP11 from Non-secure EL1 and ELO. 








1 Trap valid Non-secure accesses to CP11 to Hyp mode. 
When TCP11 is set to 1, any otherwise-valid access to CP 11 from: 
e ANon-secure EL1 or ELO access is trapped to Hyp mode. 
e Hyp mode generates an Undefined Instruction exception, taken in Hyp mode. 





[10] TCP10 Trap coprocessor 10. The possible values are: 


0 IfNSACR.CP10 is set to 1, then Hyp mode can access CP10, regardless of the value of CPACR.CP10. This is 
the reset value. 
Note 
This bit value has no effect on possible use of CP10 from Non-secure EL1 and ELO. 








1 Trap valid Non-secure accesses to CP10 to Hyp mode. 
When TCP10 is set to 1, any otherwise-valid access to CP10 from: 
e A Non-secure EL1 or ELO access is trapped to Hyp mode. 
e Hyp mode generates an Undefined Instruction exception, taken in Hyp mode. 





[9:0] - Reserved, RES1. 





To access the HCPTR in AArch32 state, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c1, c1, 2; Read Hyp Architectural Feature Trap Register 
MCR p15, 4, <Rt>, c1, c1, 2; Write Hyp Architectural Feature Trap Register 


Related information 
4.5.8 Non-secure Access Control Register on page 4-251. 
4.3.35 Architectural Feature Trap Register, EL2 on page 4-137. 


4.5.14 Translation Table Base Register 0 and Register 1 


The processor does not use any IMPLEMENTATION DEFINED bits in the 32-bit TTBRO and TTBRI1 format, so 
these bits are RESO. 


4.5.15 Translation Table Base Control Register 


The TTBCR characteristics are: 
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Purpose 
Controls which Translation Table Base Register defines the base address for a translation table 
walk required for the stage 1 translation of a memory access from any mode other than Hyp 
mode in AArch32 state. This register also controls the translation table format and, when using 
the Long-descriptor translation table format, holds cacheability and shareability information. 


The processor does not use the IMPLEMENTATION DEFINED bit, TTBCR[30], when using the Long- 
descriptor translation table format, so this bit is RESo. 


Usage constraints 
The accessibility to the TTBCR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Write access to the Secure copy of SCTLR is disabled when the CPISSDISABLE signal is 
HIGH. 


Configurations 
The TTBCR is Banked in the Secure and Non-secure states. 
The architectural mapping of the TTBCR is: 


¢ The Non-secure TTBCR is mapped to the AArch64 TCR_EL1[31:0] register. 
e The Secure TTBCR is mapped to the AArch64 TCR_EL3[31:0] register 


Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


See the ARM” Architecture Reference Manual ARMVv8 for more information. 
To access the TTBCR in AArch32 state, read or write the CP15 register with: 


MRC p15, @, <Rt>, c2, c@, 2; Read Translation Table Base Control Register 
MCR p15, @, <Rt>, c2, c@, 2; Write Translation Table Base Control Register 


Related information 
4.3.41 Translation Control Register, EL] on page 4-146. 
4.3.47 Translation Control Register, EL3 on page 4-155. 


4.5.16 Hyp Translation Control Register 


The processor does not use the IMPLEMENTATION DEFINED bit, HTCR[30], so this bit is REso. 
The HTCR characteristics are: 


Purpose 
Controls translation table walks required for the stage 1 translation of memory accesses from 
Hyp mode, and holds cacheability and shareability information for the accesses. 

Usage constraints 
The accessibility to the HTCR by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW - 





Configurations 
The HTCR is: 
¢ A Banked EL2 register. 
e Architecturally mapped to the AArch64 TCR_EL2. 


The TCR_EL2 is a 32-bit register in AArch64 state. 
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Attributes 
See the register summary in Table 4-85 cl register summary on page 4-217. 


See the ARM” Architecture Reference Manual ARMV8 for more information. 
To access the HTCR in AArch32 state, read or write the CP15 register with: 


MRC p15, 4, <Rt>, c2, c@, 2; Read Hyp Translation Control Register 
MCR p15, 4, <Rt>, c2, c@, 2; Write Hyp Translation Control Register 


Related information 
4.3.42 Translation Control Register, EL2 on page 4-149. 


4.5.17 Data Fault Status Register 


The DFSR characteristics are: 


Purpose 

Holds status information about the last data fault. 
Usage constraints 

The accessibility to the DFSR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 


- RW RW RW RW RW 





Configurations 
The DFSR is Banked for Secure and Non-secure states. 
The architectural mapping of the DFSR is: 
e The Non-secure DFSR is mapped to the AArch64 ESR_EL1 register. 
e The Secure DFSR is mapped to the AArch64 ESR_EL3 register. 


Attributes 

See the register summary in Table 4-2 AArch64 exception handling registers on page 4-78. 
There are two formats for this register. The value of TTBCR.EAE selects which format of the register is 
used. The two formats are: 


¢ DFSR format when using the Short-descriptor translation table format on page 4-268. 
¢ DFSR format when using the Long-descriptor translation table format on page 4-269. 
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DFSR format when using the Short-descriptor translation table format 


The following figure shows the DFSR bit assignments when using the Short-descriptor translation table 
format. 


16 15 14 13 1211 10 9 8 7 








AS] P= RESO 
[ee 
FS[4] 


WnR 





Figure 4-91 DFSR bit assignments for Short-descriptor translation table format 


The following table shows the DFSR bit assignments when using the Short-descriptor translation table 
format. 


Table 4-127 DFSR bit assignments for Short-descriptor translation table format 





Bits Name Function 





[31:16] - Reserved, RESO. 





[15] UA Unattributable fault. This bit is only set for System Errors. For other 
faults, it is RESO. The values are: 


0 Attributable, can be attributed to the processing element counting 
the event. 


1 Unattributable, cannot be attributed to any particular processor. 





[14] UC Uncontainable fault. This bit is only set for System Errors. For other 
faults, it is RESO. The values are: 


0 Containable, an attributable event that can be contained to a 
particular code sequence. 


1 Uncontainable, cannot be contained to a particular code sequence. 


Unattributable events are Uncontainable. 





[13] CM Cache maintenance fault. For synchronous faults, this bit indicates 
whether a cache maintenance operation generated the fault. The values 
are: 


0 Abort not caused by a cache maintenance operation. 


1 Abort caused by a cache maintenance operation. 


On an asynchronous fault, this bit is UNKNOWN. 





[12] ExT External abort type. This field indicates whether an AXI decode or slave 
error caused an abort: 


0 External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 
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Table 4-127 DFSR bit assignments for Short-descriptor translation table format (continued) 























Bits Name Function 

[11] WnR Write not Read bit. This field indicates whether a write or a read access 
caused the abort: 
0 Abort caused by a read access. 
1 Abort caused by a write access. 
For faults on CP15 cache maintenance operations, including the VA to 
PA translation operations, this bit always returns a value of 1. 

[10] FS[4] Part of the Fault Status field. See bits[3:0] in this table. 

[9] LPAE Large physical address extension. The value of the format descriptor is: 
0 Short-descriptor translation table formats. 

[8] - Reserved, RESO. 

[7:4] Domain The domain of the fault address. Use of the field is deprecated. 

[3:0] FS[3:0] Fault Status bits. This field indicates the type of exception generated. 


The possible values are: 


@beeee1 Alignment fault. 


@b@110@ Synchronous external abort on translation table walk, 1st 
level. 


@b@111@ Synchronous external abort on translation table walk, 2nd 
level. 


@b111@@ Synchronous parity error on translation table walk, 1st 
level. 


@b1111@ Synchronous parity error on translation table walk, 2nd 
level. 


@bee0101 ‘Translation fault, 1st level. 

0b00111 Translation fault, 2nd level. 

0b00011 Access flag fault, 1st level. 

0b00110 Access flag fault, 2nd level. 

@be1001 Domain fault, Ist level. 

@b01011 Domain fault, 2nd level. 

@b@1101 Permission fault, 1st level. 

@b01111 Permission fault, 2nd level. 

@be@ee18 Debug event. 

@b@10@0@ Synchronous external abort, non-translation. 
@b11001 Synchronous parity error on memory access. 
@b1@11@ Asynchronous external abort. 


@b119@@ Asynchronous parity error on memory access. 


All other values are reserved. 





DFSR format when using the Long-descriptor translation table format 


The following figure shows the DFSR bit assignments when using the Long-descriptor translation table 


format. 
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Figure 4-92 DFSR bit assignments for Long-descriptor translation table format 


The following table shows the DFSR bit assignments when using the Long-descriptor translation table 
format. 


Table 4-128 DFSR bit assignments for Long-descriptor translation table format 





Bits Name Function 





[31:16] - Reserved, RESO. 





[15] UA Unattributable fault. This bit is only set for System Errors. For other 
faults, it is RESO. The values are: 


0 Attributable, can be attributed to the processing element counting 
the event. 


1 Unattributable, cannot be attributed to any particular processor. 





[14] UC Uncontainable fault. This bit is only set for System Errors. For other 
faults, it is RESO. The values are: 


0 Containable, an attributable event that can be contained to a 
particular code sequence. 


1 Uncontainable, cannot be contained to a particular code sequence. 


Unattributable events are Uncontainable. 





[13] CM Cache maintenance fault. For synchronous faults, this bit indicates 
whether a cache maintenance operation generated the fault: 


0 Abort not caused by a cache maintenance operation. 


1 Abort caused by a cache maintenance operation. 


On an asynchronous fault, this bit is UNKNOWN. 





[12] ExT External abort type. This field indicates whether an AXI decode or slave 
error caused an abort: 


0 External abort marked as DECERR. 
1 External abort marked as SLVERR. 


For aborts other than external aborts this bit always returns 0. 





[11] WnR Write not Read bit. This field indicates whether a write or a read access 
caused the abort: 


0 Abort caused by a read access. 


1 Abort caused by a write access. 


For faults on CP15 cache maintenance operations, including the VA to 
PA translation operations, this bit always returns a value of 1. 





[10] - Reserved, RESO. 
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Table 4-128 DFSR bit assignments for Long-descriptor translation table format (continued) 





Bits Name Function 





[9] LPAE Large physical address extension. The value of the format descriptor is: 


1 __Long-descriptor translation table formats. 





[8:6] - Reserved, RESO. 





[5:0] Status Fault Status bits. This field indicates the type of exception generated. 
The possible values are: 
O@bee@e@e@LL Address size fault, LL bits indicate level. 
@be001LL Translation fault, LL bits indicate level. 
@b@G@1@LL Access flag fault, LL bits indicate level. 
@b0011LL Permission fault, LL bits indicate level. 
0b010009 Synchronous external abort. 
@b@1100@ Synchronous parity error on memory access. 
@b@19001 Asynchronous external abort. 
@b@11001 Asynchronous parity error on memory access. 


@b@1@1LL Synchronous external abort on translation table walk, LL 
bits indicate level. 


@b@111LL Synchronous parity error on memory access on translation 
table walk, LL bits indicate level. 


@b199001 Alignment fault. 
@b100010 Debug event. 


All other values are reserved. 





The following table shows how the LL bits in the Status field encode the lookup level associated with the 
MMU fault. 


Table 4-129 Encodings of LL bits associated with the MMU fault 





LL bits Meaning 


00 Level 0 fault 

















01 First level 
10 Second level 
11 Third level 
To access the DFSR in AArch32 state, read or write the CP15 register with: 
MRC p15, ©, <Rt>, c5, c@, @; Read Data Fault Status Register 
MCR p15, ©, <Rt>, c5, c@, @; Write Data Fault Status Register 
Related information 
4.3.50 Exception Syndrome Register, ELI and EL3 on page 4-157. 
4.5.18 Physical Address Register 
The PAR characteristics are: 
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Purpose 

Receives the PA from any address translation operation. 
Usage constraints 

The accessibility to the PAR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Configurations 
The PAR is Banked for the Secure and Non-secure states. 


The Non-secure PAR is architecturally mapped to AArch64 PAR EL] register. 
The PAR[63:32] is Reso when using the Short-descriptor translation format. 


Attributes 
The processor does not use any IMPLEMENTATION DEFINED bits in the 32-bit or 64-bit format PAR or 
the PAR_ELI, so these bits are RESO. 


See the register summary in Table 4-90 c7 register summary on page 4-219. 
See the ARM® Architecture Reference Manual ARMV8 for more information. 


To access the PAR in AArch32 state when using the Short-descriptor translation format, read or write the 
CP15 register with: 


MRC p15, @, <Rt>, c7, c4, @; Read Physical Address Register 
MCR p15, ©, <Rt>, c7, c4, @; Write Physical Address Register 


To access the PAR in AArch32 state when using the Long-descriptor translation format, read or write the 
CP15 register with: 


MRRC p15, ©, <Rt>, <Rt2>, c7; Read Physical Address Register 
MCRR p15, ©, <Rt>, <Rt2>, c7; Write Physical Address Register 


Related information 
4.3.55 Physical Address Register, ELI on page 4-165. 


Primary Region Remap Register 


The PRRR characteristics are: 


Purpose 

Controls the top-level mapping of the TEX[0], C, and B memory region attributes. 
Usage constraints 

The accessibility to the PRRR by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Write access to the Secure copy of PRRR is disabled when the CPISSDISABLE signal is 
HIGH. 
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Configurations 
The PRRR is: 


¢ Banked for the Secure and Non-secure states. 
e Only relevant if the TTBCR.EAE bit is 0. 
e Architecturally mapped to the MAIRO register in AArch32 state. 


The Non-secure PRRR is architecturally mapped to the AArch64 MAIR_EL1[31:0] register. 
The Secure PRRR is mapped to the AArch64 MAIR EL3[31:0] register. 


Attributes 
See the register summary in Table 4-94 c10 register summary on page 4-222. 


See the ARM® Architecture Reference Manual ARMV8 for more information. 
To access the PRRR in AArch32 state when TTBCR.EAE is 0, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c10, c2, @; Read Primary Region Remap Register 
MCR p15, ©, <Rt>, c10, c2, 0; Write Primary Region Remap Register 


4.5.20 Memory Attribute Indirection Register 0 


The processor does not set any IMPLEMENTATION DEFINED attributes with the Memory Attribute Indirection 
Register 0 (MAIRO). 


4.5.21 Normal Memory Remap Register. 


The NMRR characteristics are: 


Purpose 
Provides additional mapping controls for memory regions that are mapped as Normal memory 
by their entry in the PRRR. 

Usage constraints 
The accessibility to the NMRR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





Write access to the Secure copy of NMRR is disabled when the CPISSDISABLE signal is 
HIGH. 


Configurations 
The NMRR is: 


e Banked for the Secure and Non-secure states. 
e Only relevant if the TTBCR.EAE bit is 0. 
e Architecturally mapped on to the MAIRI register in AArch32 state. 


The Non-secure NMRR is architecturally mapped to the AArch64 MAIR_EL1[63:32] register. 
The Secure NMRR is mapped to the AArch64 MAIR_EL3[63:32] register. 


Attributes 
See the register summary in Table 4-94 c10 register summary on page 4-222. 


See the ARM” Architecture Reference Manual ARMV8 for more information. 
To access the NMRR in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c10, c2, 1; Read Normal Memory Remap Register 
MCR p15, ©, <Rt>, c10, c2, 1; Write Normal Memory Remap Register 
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4.5.22 Memory Attribute Indirection Register 1 


The processor does not set any IMPLEMENTATION DEFINED attributes with the Memory Attribute Indirection 
Register I (MAIR1). 


4.5.23 FCSE Process ID Register 


The processor does not implement Fast Context Switch Extension (FCSE), so this register is always RESO. 


4.5.24 Configuration Base Address Register 


The CBAR characteristics are: 


Purpose 

Holds the physical base address of the memory-mapped GIC CPU interface registers. 
Usage constraints 

The accessibility to the CBAR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 
Configurations 
The CBAR is Common to the Secure and Non-secure states. 
Attributes 


See the register summary in Table 4-98 c15 register summary on page 4-224. 
The following figure shows the CBAR bit assignments. 


31 18 17 12 11 0 


PERIPHBASE[31:18] PERIPHBASE[43:32] 


Figure 4-93 CBAR bit assignments 
The following table shows the CBAR bit assignments. 


Table 4-130 CBAR bit assignments 





Bits Name Function 





[31:18] PERIPHBASE[31:18] The primary input PERIPHBASE[31:18] determines the reset value. 





[17:12] - Reserved, RESO. 





[11:0] .PERIPHBASE[43:32] The primary input PERIPHBASE[43:32] determines the reset value. 





To access the CBAR in AArch32 state, read the CP15 register with: 


MRC p15, 1, <Rt>, c15, c3, @; Read Configuration Base Address Register 
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Chapter 5 
Memory Management Unit 


This section describes the Memory Management Unit (MMU). 


It contains the following sections: 

e 5.1 About the MMU on page 5-276. 

e 5.2 TLB organization on page 5-277. 

e 5.3 TLB match process on page 5-278. 

¢ 5.4 Memory access sequence on page 5-279. 

e 5.5 MMU enabling and disabling on page 5-281. 

¢ 5.6 Intermediate table walk caches on page 5-282. 
e 5.7 External aborts on page 5-283. 
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5.1 About the MMU 


The Cortex-A72 processor is an ARMv8 compliant processor that supports execution in both the 
AArch64 and AArch32 states. 


In AArch32 state, the ARMv8 address translation system resembles the ARMv7 address translation 
system with LPAE and Virtualization Extensions. In AArch64 state, the ARMv8 address translation 
system resembles an extension to the Long Descriptor Format address translation system to support the 
expanded virtual and physical address spaces. For more information regarding the address translation 
formats, see the ARM” Architecture Reference Manual ARMVvé. Key differences between the AArch64 
and AArch32 address translation systems are that the AArch64 state provides the ability to: 


e Select the translation granule to either be 4KB or 64KB. In AArch32, the translation granule is 
limited to be 4KB. 

e Configure the ASID size to be either 8-bit or 16-bit. In AArch32, the ASID is limited to an 8-bit 
value. 


The maximum supported physical address size is: 


e 44-bit in AArch64 state. 
e 40-bit in AArch32 state. 


The MMU controls table walk hardware that accesses translation tables in memory. The MMU works 
with the L1 and L2 memory system to translate a Virtual Address (VA) to a Physical Address (PA). The 
MMU enables fine-grained memory system control through a set of virtual-to-physical address mappings 
and memory attributes held in the L1 and L2 Translation Look-aside Buffers (TLBs). 


The MMU has the following features: 

e 48-entry fully-associative L1 instruction TLB. 

e 32-entry fully-associative L1 data TLB for data load and store pipelines. 

e 4-way set-associative 1024-entry L2 TLB in each processor. 

e Intermediate table walk caches. 

¢ The TLB entries contain a global indicator or an Address Space Identifier (ASID) to permit context 
switches without TLB flushes. 

¢ The TLB entries contain a Virtual Machine Identifier (VMID) to permit virtual machine switches 
without TLB flushes. 
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5.2 TLB organization 
The Cortex-A72 processor implements a 2-level TLB structure. 


The TLBs, at either the L1 or the L2 level, do not require to be flushed on a context or virtual machine 
switch. The MMU does not support the locking of TLB entries at either Level 1 or Level 2. 


This section contains the following subsections: 
e 5.2.1 LI instruction TLB on page 5-277. 

¢ 5.2.2 LI data TLB on page 5-277. 

e 5.2.3 L2 TLB on page 5-277. 


5.2.1 L1 instruction TLB 


The L1 instruction TLB is a 48-entry fully-associative structure. This TLB caches entries of three 
different page sizes, natively 4KB, 64KB, and 1MB, of VA to PA mappings. If the page tables map the 
memory region to a larger granularity than 1MB, it only allocates one mapping for the particular 1MB 
region to which the current access corresponds. 


A hit in the instruction TLB provides a single CLK cycle access to the translation, and returns the PA to 
the instruction cache for comparison. It also checks the access permissions to signal a Prefetch Abort. 


5.2.2 L1 data TLB 


The L1 data TLB is a 32-entry fully-associative TLB that is used for data loads and stores. This TLB 
caches entries of three different page sizes, natively 4KB, 64KB, and 1MB, of VA to PA mappings. 


A hit in the data TLB provides a single CLK cycle access to the translation, and returns the PA to the 
data cache for comparison. It also checks the access permissions to signal a Data Abort. 


5.2.3 L2 TLB 


Misses from the L1 instruction and data TLBs are handled by a unified L2 TLB. This is a 1024-entry 4- 
way set-associative structure. The L2 TLB supports the page sizes of 4K, 64K, 1MB and 16MB. It also 
supports page sizes of 2MB and 1GB for the long descriptor format translation in AArch32 state and in 
AArch64 state when using the 4KB translation granule. In addition, the L2 TLB supports the 512MB 
page map size defined for the AArch64 translations that use a 64KB translation granule. 


Accesses to the L2 TLB take a variable number of cycles, based on the competing requests from each of 
the L1 TLBs, TLB maintenance operations in flight, and the different page size mappings in use. 
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5.3 TLB match process 
The ARMv8-A architecture provides for multiple VA spaces that are translated differently. 


The TLB entries store all the required context information to facilitate a match and avoid the requirement 
for a TLB flush on a context or virtual machine switch. Each TLB entry contains a VA, page size, PA, 
and a set of memory properties that include the memory type and access permissions. Each entry is 
associated with a particular ASID, or as global for all application spaces. The TLB entry also contains a 
field to store the VMID in the entry, applicable to accesses made from the Non-secure state. There is also 
a memory space identifier that records whether the request occurred at the EL3 Exception level, Non- 
secure EL2 Exception level, or Secure and Non-secure ELO or EL1 Exception levels. A TLB entry match 
occurs when the following conditions are met: 
e Its VA, moderated by the page size such as the VA bits[48:N], where N is log» of the page size for 
that translation stored in the TLB entry, matches that of the requested address. 
e The memory space matches the memory space state of the requests. The memory space can be one of 
four values: 
— Secure EL3. 
— Non-secure EL2. 
— Secure ELO or ELI. 
— Non-secure ELO or EL1. 
e The ASID matches the current ASID held in the CONTEXTIDR, TTBRO, or TTBR1 register or the 
entry is marked global. 
e The VMID matches the current VMID held in the VTTBR register. 


Note 


e For a request originating from EL2 or EL3, the ASID and VMID match are ignored. 
¢ For a request originating from Secure state, the VMID match is ignored. 








ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 5-278 
Non-Confidential 


5 Memory Management Unit 
5.4 Memory access sequence 


5.4 Memory access sequence 
When the processor generates a memory access, the MMU: 


1. Performs a lookup for the requested VA, current ASID, current VMID, and memory space in the 
relevant L1 instruction or data TLB. 

2. Performs a lookup for the requested VA, current ASID, current VMID, and memory space in the 
unified L2 TLB if there is a miss in the relevant L1 TLB. 

3. Performs a hardware translation table walk if there is a miss in the L2 TLB. 


When executing in AArch64 at a particular Exception level, you can configure the hardware translation 
table walk to use either the 4KB translation granule or the 64KB translation granule. Program the 
Translation Granule bit, TGO, in the appropriate translation control register: 


e TCR EL]. 
e TCR EL2. 
e TCR EL3. 
* VTCR EI2. 


When executing in AArch32 in a particular mode, you can configure the MMU to perform translation 
table walks using either the Short Descriptor Translation Table or the Long Descriptor Translation table 
format, by programming the Extended Address Enable bit, EAE, in the appropriate translation table 
control register. Only the Long Descriptor Translation format is supported in Hyp mode. 


You can configure the MMU to perform translation table walks in Cacheable regions, by programming 
the IRGN bits: 


AArch32 • Translation table base registers (TTBRO/TTBR1_ELx) when using the Short Descriptor 
translation table format. 
e TCR Elx register when using the Long Descriptor translation table format. 


AArch64 In the appropriate TCR_EL-x register. 


For Stage2 translations, the IRGN bits must be programmed in the VTCR_EL2 register. 


If the encoding of the IRGN bits is WriteBack, an L2 data cache lookup is performed and data is read 
from the data cache. If the encoding of the IRGN bits is Write-Through or Non-cacheable, an access to 
external memory is performed. 


In the case of an LZTLB miss, the hardware does a translation table walk provided the MMU is enabled, 
and the translation using the base register has not been disabled by: 


e Setting the PDO or PD1 bit in the 4.5.15 Translation Table Base Control Register on page 4-265, to 
disallow translation using either TTBRO or TTBR1 respectively, when using AArch32 along with the 
Short Descriptor Format. 

¢ Setting of the EPDO or EPD1 bit in the TCR_EL1 register when using AArch64 or when using the 
Long Descriptor format in AArch32. 


If the translation table walk is disabled for a particular base register, the processor returns a Translation 

Fault. If the TLB finds a matching entry, it uses the information in the entry as follows: 

e The access permission bits and the domain, when using the Short Descriptor format in AArch32 state, 
determine if the access is permitted. If the matching entry does not pass the permission checks, the 
MMU signals a Permission fault. See the ARM® Architecture Reference Manual ARMVv8 for: 

— A description of the various faults. 
— The fault codes. 
— Information regarding the registers where the fault codes are set. 

e The memory region attributes specified in the TLB entry determine if the access is: 

— Secure or Non-secure. 
— Inner, Outer or not Cacheable. 
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— Normal Memory or Device type, Strongly-ordered or Device type when using the Short 
Descriptor Format in AArch32. 

— One of the four different device memory types defined for ARMv8: 
Device-nGnRnE Device non-Gathering, non-Reordering, No Early Write Acknowledgment. 
Device-nGnRE Device non-Gathering, non-Reordering, Early Write Acknowledgment. 
Device-nGRE Device non-Gathering, Reordering, Early Write Acknowledgment. 
Device-GRE Device Gathering, Reordering, Early Write Acknowledgment. 

¢ The TLB translates the VA to a PA for the memory access. 
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5.5 MMU enabling and disabling 


5.5 MMU enabling and disabling 


You can enable or disable the MMU. See the ARM Architecture Reference Manual ARMv8 for more 
information. 


You must set CPUECTLR.SMPEN to 1 before the caches and MMU are enabled, or any instruction 


cache or TLB maintenance operations are performed. 


Related information 
4.3.67 CPU Extended Control Register, EL] on page 4-206. 
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5.6 Intermediate table walk caches 


5.6 Intermediate table walk caches 


The Cortex-A72 processor implements dedicated caches that store intermediate levels of translation table 
entries as part of a table walk. 


Cached entries are associated with an ASID and a VMID where applicable for Non-secure EL1 
translations. 


Care is required when using the reserved ASID method for context switch. See the ARM® Architecture 
Reference Manual ARMv8 for more information. 


The following example shows how to synchronize ASID and TTBR changes using a reserved ASID. 


Example 5-1 Using a reserved ASID to synchronize ASID and TTBR changes 





In this example, the operating system uses a particular reserved ASID value for the synchronization of 
the ASID and the Translation Table Base Register. You can use this approach only when the size of the 
mapping for any given Virtual Address is the same in the old and new translation tables. The example 
uses the value of 0. 


The software uses the following sequences that must be executed from memory marked as global: 
Change ASID to @ 
ISB 
Change Translation Table Base Register 


ISB 
Change ASID to new value 
ISB 





If the code relies on only leaf translation table entries that are cached, it can incorrectly assume that 
entries tagged with the reserved ASID are not required to be flushed. For example: 


e Global leaf entries that remain valid or must be flushed for all ASIDs when modified 
e Non-global leaf entries that are not used because the reserved ASID is not set outside the context 
switch code. 


The incorrect assumption leads to the following failure: 

e The context switch code sets the ASID to the reserved value. 

e Speculative fetching reads and caches the first level page table entry, using the current TTBR, and 
tagging the entry with the reserved ASID. This is a pointer to a second level table. 

e Context switch completes. 

e Processing continues, and the process with the page tables terminates. The OS frees and reallocates 
the page table memory. 

e A later context switch sets the ASID to the reserved value 

e Speculative fetching makes use of the cached first level page table entry, because it is tagged with the 
reserved ASID, and uses it to fetch a second level page table entry. Because the memory is 
reallocated and reused, the entry contains random data that can appear to be a valid, global entry. This 
second level page table entry is cached. 

e Context switch completes, and application execution continues. 

¢ The application references the address range covered by the cached second level page table entry. 
Because the entry is marked as global, a match occurs and so data is fetched from a random address. 


Note 
When you use a reserved ASID, you must invalidate the TLB to deallocate the translation table memory. 
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5.7 External aborts 


External memory errors are defined as those that occur in the memory system rather than those that the 
MMU detects. 


External memory errors are extremely rare. External errors are caused by errors flagged by the AXI 
interfaces or generated because of an uncorrected ECC error in the L1 data cache or L2 cache arrays 
when the request is external to the Cortex-A72 MPCore processor. You can configure external aborts to 
trap to Monitor mode by setting the EA bit in the Secure Configuration Register to 1. 


This section contains the following subsections: 


¢ 5.7.1 External aborts on data read or write on page 5-283. 
e 5.7.2 Synchronous and asynchronous aborts on page 5-283. 


5.7.1 External aborts on data read or write 


Externally generated errors during a data read or write can be asynchronous. This means that the 
ELR_EL1, ELR_EL2, ELR_EL3, ofr14 entry into the abort handler on such an abort might not hold the 
address of the instruction that caused the abort. 


The DFAR is UNPREDICTABLE when an asynchronous abort occurs. 
For a load multiple or store multiple operation, the address captured in the DFAR is that of the address 


that generated the synchronous external abort. 


5.7.2 Synchronous and asynchronous aborts 


To determine a fault type, check the Execution state. If the abort handler code targeted by the exception 
is in AArch64 state, read the appropriate ESR_EL-x register. If the abort handler code is an AArch32 
hypervisor, see 4.3.54 Exception Syndrome Register, EL2 on page 4-163. If the abort handler code is not 
an AArch32 non-hypervisor, see 4.3.5/ Instruction Fault Status Register, EL2 on page 4-159 for an 
Instruction Abort or the ">4.5./7 Data Fault Status Register on page 4-267 for a Data Abort. 


Related information 
4.5.7 Secure Configuration Register on page 4-248. 





ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. 5-283 
Non-Confidential 


Chapter 6 
Level 1 Memory System 


This section describes the Level / (L1) memory system. 


It contains the following sections: 

e 6.1 About the LI memory system on page 6-285. 
e 6.2 Cache organization on page 6-286. 

* 6.3 LI instruction memory system on page 6-287. 
e 6.4 L1 data memory system on page 6-289. 

¢ 6.5 Program flow prediction on page 6-295. 

e 6.6L1 RAM memories on page 6-297. 
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6.1 About the L1 memory system 


6.1 About the L1 memory system 
The L1 memory system consists of separate instruction and data caches. 
The L1 instruction memory system has the following features: 


e 48KB 3-way set-associative instruction cache. 

e Fixed line length of 64 bytes. 

e Parity protection per 16 bits. 

¢ Instruction cache that behaves as Physically-indexed and physically-tagged (PIPT). 
e Least Recently Used (LRU) cache replacement policy. 

e MBIST support. 


The L1 data memory system has the following features: 

e 32KB 2-way set-associative data cache. 

¢ Fixed line length of 64 bytes. 

¢ ECC protection per 32 bits. 

e Data cache that is PIPT. 

e Out-of-order, speculative, non-blocking load requests to Normal memory and non-speculative, non- 
blocking load requests to Device memory. 

e LRU cache replacement policy. 

e Hardware prefetcher that generates prefetches targeting both the L1 data cache and the L2 cache. 

e MBIST support. 


Note 


The Cortex-A72 processor does not support cache lockdown. 
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6.2 Cache organization 


6.2 Cache organization 
You can disable each cache independently. 


On a cache miss, critical word-first filling of the cache is performed. 


Related information 
4.5.5 System Control Register on page 4-242. 
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6.3 L1 instruction memory system 


6.3 L1 instruction memory system 
The instruction cache can source up to 128 bits per fetch depending on alignment. 


Sequential cache read operations reduce the number of full cache reads. This has the benefit of reducing 
power consumption. If a cache read is sequential to the previous cache read, and the read is within the 
same cache line, only the data RAM way that was previously read is accessed. 


The L1 instruction cache appears to software as a physically tagged, physically indexed array. Therefore, 
the instruction cache is only required to be flushed when writing new data to an instruction address. 


This section contains the following subsections: 

¢ 6.3.1 Instruction cache disabled behavior on page 6-287. 

¢ 6.3.2 Instruction cache speculative memory accesses on page 6-287. 
e 6.3.3 Fill buffers on page 6-287. 

¢ 6.3.4 Non-cacheable fetching on page 6-288. 

e 6.3.5 Parity error handling on page 6-288. 

¢ 6.3.6 Hardware L] I-cache prefetching on page 6-288. 


6.3.1 Instruction cache disabled behavior 


The SCTLR.I bit enables or disables the L1 instruction cache. If the I bit is disabled, fetches cannot 
access any of the instruction cache arrays. An exception to this rule is the instruction cache system 
operations. If the instruction cache is disabled, the instruction cache maintenance operations can still 
execute normally. 


Related information 
4.5.5 System Control Register on page 4-242. 


6.3.2 Instruction cache speculative memory accesses 


An instruction remains in the pipeline between the fetch and the execute stages. Because there can be 
several unresolved branches in the pipeline, instruction fetches are speculative, meaning there is no 
guarantee that they are executed. A branch or exceptional instruction in the code stream can cause a 
pipeline flush, discarding the currently fetched instructions. 


Because of the aggressive prefetching behavior, you must not place read-sensitive devices in the same 
page as code. Pages with Device memory type attributes are treated as Non-cacheable Normal Memory. 
You must mark pages that contain read-sensitive devices with the TLB Execute Never (XN) attribute bit. 


To avoid speculative fetches to read sensitive devices when address translation is disabled, these devices 
and code that are fetched must be separated in the physical memory map. See the ARM® Architecture 
Reference Manual ARMv8 for more information. To avoid speculative fetches to potential non-code 
regions, the static predictor is disabled and branches are forced to resolve in order when address 
translation is disabled. 


6.3.3 Fill buffers 


The instruction cache is fed by three fill buffers that hold instructions returned from the L2 cache on a 
linefill operation, or instructions from Non-cacheable regions. The fill buffers are non-blocking. An 
instruction cache hit can bypass an in-progress cache miss, even before the critical word is returned. A 
line at a given Physical Address remains in a fill buffer until the fill buffer must be reclaimed. At this 
time, the fill buffer contents are either transferred to the main instruction cache or discarded if no fetch 
has occurred to the address of the line over the lifetime of the line in the fill buffer. 
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6.3.4 Non-cacheable fetching 


Fetches occurring when the instruction cache is disabled, or from a page with attributes not indicating 
Inner Cacheable, do not result in the line entering the instruction cache. 


Incoming instructions from the L2 cache are stored in the fill buffers until the fetch reaches the end of the 
cache line or a nonsequential fetch occurs, whichever occurs first. Therefore, multiple sequential fetches 
from the same 64-byte region, corresponding to a cache line, can occur without incurring multiple L2 
requests when a region is not given Cacheable attributes. 


6.3.5 Parity error handling 


The instruction cache implements one parity bit per 16-bits of instruction data. The instruction cache Tag 
array is also protected by two parity bits per tag entry. Parity errors invalidate the offending cache line, 
and force a fetch from the L2 cache on the next access. No aborts are generated on parity errors that 
occur within the instruction cache. The location of a parity error is reported in the CPU Memory Error 
Syndrome Register. Because the data cache shares this register, there is no guarantee that this register 
contains the location of the last instruction side parity error. 


Related information 
4.3.68 CPU Memory Error Syndrome Register, ELI on page 4-209. 


6.3.6 Hardware L1 I-cache prefetching 


The processor implements speculative prefetching on the instruction side. Following an L1 I-cache miss, 
the next sequential line is looked up in the L1 instruction cache. If a miss is indicated, and no pipeline 
flushes have occurred, a second L2 request is initiated for the next sequential line. This line is not 
committed to the instruction cache unless actually demanded by a fetch. This is the default behavior. 
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6.4 L1 data memory system 
The L1 data memory system executes all memory operations in the Cortex-A72 processor. 


In addition, it handles cache maintenance operations, TLB maintenance operations, and exclusive 
operations using the Load-Exclusive, Store-Exclusive and Clear-Exclusive instructions. 


The L1 memory system supports out-of-order execution of instructions. Loads can be executed and 
return their data while they are still speculative and might be flushed. Stores can be executed, but not 
committed to memory, while they are still speculative. Speculative loads can forward data from older 
speculative stores. 


The L1 memory system is non-blocking and supports hit-under-miss. For Normal memory, up to six 64- 
byte cache line requests can be outstanding at a time. While those requests are waiting for memory, loads 
to different cache lines can hit the cache and return their data. 


The L1 data memory system includes the following: 

e LI data cache. 

e Address generation logic. 

¢ The LI TLB. 

¢ Buffering for stores that have not been written to the cache or memory. 
e Fill buffers for processing cache line fills and Non-cacheable reads. 

e Coherence logic for handling snoop requests. 

e Hardware prefetch logic. 


This section contains the following subsections: 

¢ 6.4.1 Behavior for different memory types on page 6-289. 

e 6.4.2 Coherence on page 6-291. 

e 6.4.3 Cache disabled behavior on page 6-292. 

¢ 6.4.4 Non-cacheable streaming enhancement on page 6-292. 
e 6.4.5 Synchronization primitives on page 6-292. 

¢ 6.4.6 Load/Store unprivileged instructions on page 6-293. 

e 6.4.7 Preload instruction behavior on page 6-293. 

¢ 6.4.8 Error Correction Code on page 6-293. 

¢ 6.4.9 Load/store hardware prefetcher on page 6-294. 


6.4.1 Behavior for different memory types 


The L1 data memory system uses memory attributes from the MMU to determine the behaviors of 
memory transactions to regions of memory. 


The L1 data memory system uses the following memory types: 


e Write-Back Read-Write-Allocate on page 6-290. 
¢ Write-Back No-Allocate on page 6-291. 

¢ Write-Through on page 6-291. 

e Non-cacheable on page 6-291. 

e Device on page 6-291. 


Note 


Some attribute combinations are only available if the LPAE page table format is used. 








Table 6-1 Memory attribute combinations on page 6-290 shows the memory attribute combinations 
available. 
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Table 6-1 Memory attribute combinations 





Outer MemAttr Inner MemAttr Cortex-A72 processor internal memory type 














Device nGnRnE Device nGnRnE 
Device nGnRE Device nGnRE 
Device nGRE Device nGRE 
Device GRE Device GRE 





Non-cacheable 


Non-cacheable 


Non-cacheable 





Non-cacheable 


Write-Through 


Non-cacheable 





Non-cacheable 


Write-Back 


Non-cacheable 





Write-Through 


Non-cacheable 


Non-cacheable 





Write-Through 


Write-Through 


Non-cacheable 





Write-Through 


Write-Back 


Non-cacheable 


























Write-Back Non-cacheable Non-cacheable 

Write-Back Write-Through Non-cacheable 

Write-Back Write-Back No-Allocate Write-Back No-Allocate 
Write-Back Write-Back Read-Allocate Write-Back Read-Write-Allocate 
Write-Back Write-Back Write-Allocate Write-Back Read-Write-Allocate 
Write-Back Write-Back Read-Write-Allocate Write-Back Read-Write-Allocate 





The L1 and L2 data memory system use the internal memory type to determine its behavior in addition to 
the value of the ARCACHE, AWCACHE, and TXREQFLIT[MemAttr] signals. The L1 and L2 caches 
use allocation hints from the inner memory attributes and the ARCACHE, AWCACHE, and 
TXREQJ[MemAttr] signals use allocation hints from the outer memory attributes. 

Note 


The Cortex-A72 processor provides the raw memory attributes from the MMU on external signals. 








If any memory instruction crosses a 4KB page boundary between two pages with different memory types 
such as Normal and Device memory, the result is unpredictable and an abort might be triggered or 
incorrect data delivered. 


If any given Physical Address is mapped to Virtual Addresses with different memory types or different 
cacheability such as Non-cacheable, Write-Through, or Write-Back, the result is unpredictable. This can 
occur if two Virtual Addresses are mapped to the same Physical Address at the same time with different 
memory type or cacheability, or if the same Virtual Address has its memory type or cacheability changed 
over time without the appropriate cache cleaning or barriers. 


Write-Back Read-Write-Allocate 


This is expected to be the most common and highest performance memory type. Any read or write to this 
memory type searches the cache to determine if the line is resident. If it is, the line is read or updated. A 
store that hits a Write-Back cache line does not update main memory. 


If the required cache line is not in the cache, one or more cache lines is requested from the L2 cache. The 
L2 cache can obtain the lines from its cache, from another coherent L1 cache, or from memory. The line 
is then placed in the L1 cache, and the operation completes from the L1 cache. 
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Write-Back No-Allocate 


Use Write-Back No-Allocate memory to access data that might be in the cache because other virtual 
pages that are mapped to the same Physical Address are Write-Back Read-Write-Allocate. Write-Back 
No-Allocate memory avoids polluting the caches when accessing large memory structures that are used 
only one time. The cache is searched and the correct data is delivered or updated if the data resides in one 
of the caches. However, if the request misses the L1 or L2 cache, the line is not allocated into that cache. 
For a read that misses all caches, the required data is read to satisfy the memory request, but the line is 
not added to the cache. For a write that misses in all caches, the modified bytes are updated in memory. 


Note 


The No-Allocate allocation hint is only a performance hint. The processor might in some cases, allocate 
Write-Back No-Allocate lines into the L1 data cache or the L2. 








Write-Through 


The Cortex-A72 processor memory system treats all Write-Through pages as Non-cacheable. 


Non-cacheable 


Normal Non-cacheable memory is not looked up in any cache. The requests are sent directly to memory. 
Read requests might over-read in memory, for example, reading 64 bytes of memory for a 4-byte access, 
and a single external memory access might satisfy multiple memory requests. Write requests might 
merge with other write requests to the same bytes or nearby bytes. 


Device 


Device memory types are used for communicating with input and output devices and memory-mapped 
peripherals. They are not looked up in any cache. 


All the memory operations for a single instruction can be sent to the interconnect as multiple naturally 
aligned requests. 


Related information 
Chapter 5 Memory Management Unit on page 5-275. 
A.8 ACE and CHI interface signals on page Appx-A-540. 


6.4.2 Coherence 


All memory requests for pages that are marked as Inner Shareable in the page tables and are Write-Back 
Cacheable, regardless of allocation policy, are coherent in all the caches that comprise the inner domain. 
At a minimum, this includes the L1 data cache of the executing core, the L2 cache, and all other L1 data 
caches in the processor. The inner domain might contain additional caches outside the processor 
depending on how the system is configured. 


It is unpredictable whether memory requests for pages that are marked as Inner Non-shareable are 
coherent with the processor. No code must assume that Non-shareable pages are incoherent among the 
caches. 


The L1 data cache implements a MESI coherence protocol. 
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6.4.3 Cache disabled behavior 


When you clear the C bit in the CP15 System Control Register for a given processor, data caching is 
disabled and no new cache lines are allocated to the L1 data cache and L2 cache because of data requests 
from that processor. This is important when cleaning and invalidating the caches for power down. 


Cache lines can be allocated from memory requests of other processors, unless their cache enable bits are 
also cleared. The effect on the L1 memory system is that all Write-Back Read-Write-Allocate pages are 
treated as Non-cacheable pages. 


When you disable the cache, all Write-Back Cacheable requests do not look up the L1 data cache. L1 
cache still services the snoops from the L2 cache. 


Related information 
4.5.5 System Control Register on page 4-242. 


6.4.4 Non-cacheable streaming enhancement 


You can enable the CPUACTLR[24], Non-cacheable streaming enhancement bit, only if your memory 
system meets the requirement that cache line fill requests from the processor are atomic. Specifically, if 
the processor requests a cache line fill on the AXI master read address channel, any given write request 
from a different master is ordered completely before or after the cache line fill read. This means that after 
the memory read for the cache line fill starts, writes from any other master to the same cache line are 
stalled until that memory read completes. Setting this bit enables higher performance for applications 
with streaming reads from memory types that do not allocate into the cache. 


Because it is possible to build an AXI interconnect that does not comply with the specified requirement, 
the CPUACTLR[24] bit defaults to disabled. 


6.4.5 Synchronization primitives 


The L1 memory system supports the Load-Exclusive, Store-Exclusive, and Clear-Exclusive 
synchronization primitive instructions. For all Non-shareable memory pages, the synchronization 
primitives are supported with a local monitor that is in each L1 memory system. For Shareable memory 
pages, the local monitor is used in conjunction with a global monitor. Where the global monitor resides 
depends on the memory type and cacheability. 


Internal coherent global monitor 


If synchronization primitives are used for memory pages that are Shareable Normal Write-Back and the 
cache is enabled, SCTLR.C is 1, the external monitor on AXI is not used. Instead, the global monitor 
function is handled in the L1 cache using the cache coherence information. 


External global monitor 


If synchronization primitives are used for memory pages that are Device, or Inner-Shareable Normal 
Non-cacheable, a global monitor must be provided in the interconnect. See the ARM® Architecture 
Reference Manual ARMV8, for ARMv8-A architecture profile for more information. The memory requests 
are sent on the AXI interface as Read-Exclusive or Write-Exclusive. See the ARM® AMBA® AXI and ACE 
Protocol Specification for more information. 


Note 


Use of synchronization primitives on addresses in regions marked as Device memory is UNPREDICTABLE in 
the ARMv8-A architecture. Code that makes such accesses is not portable. 











ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 6-292 
Non-Confidential 


6 Level 1 Memory System 
6.4 L1 data memory system 


6.4.6 Load/Store unprivileged instructions 


The load/store unprivileged instructions are used in privileged modes to emulate User mode instructions 
and to enforce User mode permissions. These instructions are for all memory types when enforcing 
permission checking against the permissions that the page table specifies. The User mode permissions 
from the page table are used instead of the privileged mode permissions. 


You can also use these instructions to modify the privileged and user information on the ARPROT and 
AWPROT signals on the AXI. This is required if external permission checking hardware exists in the 
fabric memory. 


The LDRT and STRT instructions for Strongly-ordered and Device pages appear on the AXI with an 
AxPROT value that indicates User mode access. However, the same instructions for Normal Memory 
might not always result in AXI transactions with an AxPROT value that indicates User mode access. 
This is because any Normal Memory page permits speculative prefetching at any time. Those prefetch 
requests, either caused by hardware prefetching or speculative prefetching triggered by flushed memory 
instructions, can have a value of the AxPROT field that indicates privileged mode access. This reflects 
the mode of the processor during the prefetch. 


For Normal Write-Through Cacheable or Non-cacheable memory, the processor can still access the 
memory speculatively, and can merge multiple stores together before issuing them to the AXI. Because 
of this, you must use the LDRT and STRT instructions to present User mode on AxPROT if the LDRT and 
STRT instructions are preceded and followed by DMB instructions: 


e DMB. 
e LDRT or STRT. 
¢ DMB. 


The DMB instructions prevent the LDRT or STRT instruction from hitting any previously requested read 
data, or from merging with any other requests. The DMB instructions can be DMBSY, DMBISH, DMBISH, and 
DMBOSH. 


6.4.7 Preload instruction behavior 


The multiprocessor supports the PLD, PLDW, and PRFM prefetch hint instructions. For Normal Write-Back 
Cacheable memory page, the PLD, PLDW, and PRFM L1 instructions cause the line to be allocated to the L1 
data cache of the executing processor. The PLD instruction brings the line into the cache in Exclusive or 
Shared state and the PLDw instruction brings the line into the cache in Exclusive state. The preload 
instruction cache, PLDI, is treated as a NOP. PLD and PLDw instructions are performance hints instructions 
only and might be dropped in some cases. 


6.4.8 Error Correction Code 


The L1 data cache supports optional single bit correct and double bit detect error correction logic in both 
the Tag and Data arrays. The ECC granularity for the Tag array is the tag for a single cache line and the 
ECC granularity for the Data array is a 32-bit word. 


Because of the ECC granularity in the Data array, a write to the array cannot update a portion of a 4-byte 
aligned memory location because there is not enough information to calculate the new ECC value. This 
is the case for any store instruction that does not write one or more aligned 4-byte regions of memory. In 
this case, the L1 data memory system reads the existing data in the cache, merges in the modified bytes, 
and calculates the ECC from the merged value. The L1 memory system attempts to merge multiple stores 
together to meet the aligned 4-byte ECC granularity and to avoid the read-modify-write requirement. 


Single bit ECC errors in the Tag or cache are corrected in the background. Because the line is removed 
from the L1 cache as part of the correction process, no software intervention is required. No exception or 
interrupt is generated. The CPU Memory Error Syndrome Register is updated to indicate a nonfatal error. 
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Double bit ECC errors in the Tag or cache are detected and an imprecise Data Abort is triggered. The 
line that contains the error is evicted from the cache. When a double bit error is reported, you must 
assume that data corruption has occurred and handle this appropriately. 


For any detected ECC error in the L1 memory system, the CPU Memory Error Syndrome Register is 
updated. For the first error reported, the register is updated with information for the RAM, bank, way, 
and index that contain the error. If that same location reports multiple errors, the repeat error count is 
incremented. If any other RAM locations report errors, the other error count is incremented. Double-bit 
ECC errors set the fatal bit. When the register is written with zeros, the register clears all counts and 
starts to monitor for a new first error again. 


Related information 
4.3.68 CPU Memory Error Syndrome Register, EL1 on page 4-209. 


6.4.9 Load/store hardware prefetcher 


The Load/store unit includes a hardware prefetcher that is responsible for generating prefetches targeting 
both the L1D cache and L2 cache. 


Prefetching on loads 


The load side prefetcher uses a hybrid mechanism which is based on both physical-address (PA) and 
virtual-address (VA) prefetching to either or both of the L1D cache and L2 cache, depending on the 
memory access patterns. 


Prefetching on stores 
Prefetching on store accesses is managed by a PA based prefetcher and only prefetches to the L2 cache. 


The Load/Store HW prefetcher can be controlled in the following manner using software programmable 

bits: 

1. Disable the Load/Store HW prefetcher: The load/store HW prefetcher can be disabled by setting the 
CPUACTLR_ ELl! bit [56]. 

2. Disable VA based prefetch: Prefetching using VA can be disabled by setting the CPUACTLR_EL1 
bit [43]. When set, prefetch is restricted to within the page boundary of the demand request triggering 
that triggers the prefetch. 

3. Disable prefetch on store: Prefetching on stores can be disabled by setting the CPUACTLR_EL] bit 
[42]. 

4. Maximum load prefetch distance to L2: You can control the maximum prefetch distance to the L2, for 
load side prefetching, by programming bits [33:32] of the CPUECTLR_ELI register. 


Related information 
4.3.66 CPU Auxiliary Control Register, EL] on page 4-194. 
4.3.67 CPU Extended Control Register, ELI on page 4-206. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 6-294 
Non-Confidential 


6 Level 1 Memory System 
6.5 Program flow prediction 


6.5 Program flow prediction 
The Cortex-A72 processor contains program flow prediction hardware, also known as branch prediction. 


With program flow prediction disabled, all taken branches incur a penalty associated with flushing the 
pipeline. To avoid this penalty, the branch prediction hardware operates at the front of the instruction 
pipeline. The branch prediction hardware consists of: 

¢ A Branch Target Buffer (BTB) to identify branches and provide targets for direct branches. 

e 2-level global history-based direction predictor. 

e Indirect predictor to provide targets for indirect branches. 

e Return stack. 

e Static predictor. 


The combination of global history-based direction predictor and BTB are called dynamic predictor. 


This section contains the following subsections: 

¢ 6.5.1 Predicted and non-predicted instructions on page 6-295. 
¢ 6.5.2 Return stack predictions on page 6-295. 

e 6.5.3 Indirect predictor on page 6-296. 

e 6.5.4 Static predictor on page 6-296. 

¢ 6.5.5 Enabling program flow prediction on page 6-296. 

¢ 6.5.6 BTB invalidation and context switches on page 6-296. 


6.5.1 Predicted and non-predicted instructions 
This section describes the instructions that the processor predicts. 


Unless otherwise specified, the list applies to A32, T32, and A64 instructions. As a general rule, the 
branch prediction hardware predicts all branch instructions regardless of the addressing mode, including: 


e Conditional branches. 

e Unconditional branches. 

e Indirect branches. 

e Branches that switch between ARM and Thumb states. 

e PC destination data processing operations. 

* BX3J, because of the inclusion of the trivial Jazelle implementation, this degenerates to a BX 
instruction. There is no BXJ instruction in A64. 


However, the following branch instructions are not predicted: 

e AArch32 instructions with the S suffix are not predicted because they are typically used when 
returning from exceptions and have side effects that can change privilege mode and Security state. 

« All mode or Exception level changing instructions. 


In Thumb state, you can make a branch that is normally encoded as unconditional conditional by 
including an [f-Then (IT) block. It is then treated as a normal conditional branch. 


6.5.2 Return stack predictions 


The return stack stores the address and the ARM or Thumb state of the instruction after a function-call 
type branch instruction. This address is the same as the Link Register value stored in r14 in AArch32 
state or X30 in AArch64 state. The following instructions cause a return stack push if predicted: 


e BL immediate. 

* BLX(1) immediate in AArch32 state. 
* BLX(2) register in AArch32 state. 
e BLR register in AArch64 state. 
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The following AArch32 instructions cause a return stack pop if predicted: 
e BX r14 

e MOV pc, r14. 

e LDMIA sp!, {..pc}. 

e LDR pc, [sp], #4. 


The LDMIA and LDR instruction address modes are correspondent with popping the return address of a full 
descending stack. In AArch64 state, the RET instruction causes a return stack pop. There is no 
dependency on a specific return address target register, for example X30. 


Because return-from-exception instructions can change the processor privilege mode and Security state, 
they are not predicted. This includes the ERET, RFE, and LDM(3) instruction, and the MOVS pc, r14 
instruction. 


6.5.3 Indirect predictor 
The indirect predictor can predict indirect branches that are not return-type instructions. 


This predictor augments the branch address with an additional state that predicts the target address of an 
indirect branch. The conditional branch predictor still predicts the direction of conditional indirect 
branches. The indirect predictor only provides the address on a predicted taken conditional indirect 
branch. 


6.5.4 Static predictor 


Branches must be resolved one time to be predicted by the dynamic predictor. To accelerate cold startup 

of code, the processor includes a static predictor that detects branches in the code stream as follows: 

e Direct unconditional branches, B immediate, are predicted taken. 

e Direct unconditional call-type branches, BL immediate and BLX immediate, are predicted taken, and 
the preferred return address value is pushed on the return stack. 

e Unconditional return-type branches are predicted taken and the target is popped from the return stack. 


To avoid potential illegal speculation, the static predictor is disabled when the MMU is disabled. 


Related information 
6.5.2 Return stack predictions on page 6-295. 


6.5.5 Enabling program flow prediction 


Program flow prediction is always enabled and no programming is required to take advantage of 
program flow prediction. 


When reset, the processor: 


e Invalidates the BTB. 
e Resets the GHB and indirect predictor to a known state. 


No software intervention is required to prepare the prediction logic before enabling program flow 
prediction. 


6.5.6 BTB invalidation and context switches 


The BTB is tagged by all memory space information required to uniquely identify a virtual memory 
space, ASID, VMID, security, and Exception level. All predictions are checked at branch resolution time 
to ensure that a legal branch is resolved. Therefore, flushing the BTB on a context switch is not required. 
AArch6é4 state does not implement BTB flush instructions. 


The processor automatically invalidates the BTB when either stage of the MMU is disabled. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 6-296 
Non-Confidential 


6.6 L1 RAM memories 


The L1 memory system contains several RAM memories that can be configured to use ECC or parity 
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6.6 L1 RAM memories 


error detection mechanisms. 


Any RAM memory that uses ECC support can perform single bit error correction and double bit error 
detection. Contents of the RAM memories with parity support can invalidate entries if a parity error is 


detected because this data is associated with read-only structures. 


The following table shows all RAM memories contained in the LI memory system. 





Table 6-2 L1 RAM memories 
































RAM memory ECC or Parity 
L1 instruction Tag RAM Parity 

L1 instruction Data RAM Parity 

L1 instruction BTB RAM None 

L1 instruction GHB RAM None 

L1 instruction indirect predictor RAM None 

L1 data Tag RAM ECC 

L1 Data RAM ECC 

L1 PF PHT RAM None 

L2 TLB RAM“ Parity 





dn The L2 TLB RAM isa unified TLB structure that supports L1 instruction and L1 data TLB misses. 
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Chapter 7 
Level 2 Memory System 


This chapter describes the Level 2 (L2) memory system. 


It contains the following sections: 

e 7.1 About the L2 memory system on page 7-299. 
e 7.2 Cache organization on page 7-300. 

e 7.3 L2 RAM memories on page 7-306. 

e 7.4 L2 cache prefetcher on page 7-307. 

¢ 7.5 Cache coherency on page 7-308. 

e 7.6 Asynchronous errors on page 7-309. 

¢ 7.7 External coherent interfaces on page 7-310. 
e 7.8 ACP on page 7-317. 





ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. 7-298 
Non-Confidential 


7 Level 2 Memory System 
7.1 About the L2 memory system 


7.1 About the L2 memory system 


The L2 memory system consists of a tightly-coupled L2 cache and an integrated Snoop Control Unit 
(SCU), connecting up to four cores within a cluster and a configurable coherent external interface 
supporting AMBA4 (ACE) or CHI architectures. 


The L2 memory system also interfaces with an optional Accelerator Coherency Port (ACP) that is 
implemented as an AXI slave interface. 


The features of the L2 memory system include: 

e Configurable L2 cache size of 512KB, 1MB, 2MB and 4MB. 

e Fixed line length of 64 bytes. 

e Physically indexed and tagged cache. 

e 16-way set-associative cache structure. 

e Banked pipeline structures. 

e Inclusion property with L1 data caches. 

¢ Software-programmable pseudo-least-recently-used or pseudo-random cache-replacement policy. 

e Configurable 128-bit wide ACE or 128-bit wide CHI interface with support for multiple outstanding 
requests. 

e Optional 128-bit wide ACP with support for multiple incoming requests. 

e Duplicate copies of the L1 data cache directories for coherency support. 

e Configurable number of Fill/Eviction Queue (FEQ) entries to 20, 24, or 28. 

e Optional Error Correction Code (ECC) support. 

e Optional hardware prefetch support. 

e Software-programmable variable latency RAMs. 

e Register slice support for large L2 cache sizes to minimize impact on routing delays. 

e MBIST support. 


Note 
¢ The Cortex-A72 processor does not support TLB or cache lockdown. 








Related information 

7.2.2 Strictly-enforced inclusion property with L] data caches on page 7-300. 
7.2.4 Error Correction Code on page 7-301. 

7.2.5 Register slice support for large cache sizes on page 7-301. 
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7.2 Cache organization 


The L2 cache is 16-way set-associative of configurable size. The cache is physically-addressed. The 
cache sizes are configurable with sizes of 512KB, 1MB, 2MB, and 4MB. 


You can configure the L2 memory system pipeline to insert wait states to take into account the latencies 
of the compiled memories for the implementation of the RAMs. 


The L2 cache incorporates a single dirty bit per cache line. A write to a cache line results in the line 
being written back to memory after the line is evicted from the L2 cache. 


This section contains the following subsections: 

e 7.2.1 L2 cache bank structure on page 7-300. 

e 7.2.2 Strictly-enforced inclusion property with LI data caches on page 7-300. 
e 7.2.3 Enabling and disabling the L2 cache on page 7-301. 

e 7.2.4 Error Correction Code on page 7-301. 

e 7.2.5 Register slice support for large cache sizes on page 7-301. 


7.2.1 L2 cache bank structure 


The L2 cache is partitioned into multiple banks to enable parallel operations. The following levels of 

banking exist: 

¢ The Tag array is partitioned into multiple banks to enable up to two requests to access different tag 
banks of the L2 cache simultaneously. 

e Each tag bank is partitioned into multiple data banks to enable streaming accesses to the data banks. 
Each tag bank consists of four data banks. 


Figure 7-1 L2 cache bank structure on page 7-300 shows the logical representation of an L2 cache bank 
structure with a configuration of all possible tag and data bank combinations. 


Tag bank selected by PA [6] 
Data bank selected by PA [5:4] 
















































































Data bank 0 Data bank 0 
Data bank 1 Data bank 1 
Tag bank 0 requests | >| Data bank 2 Tag bank 1 requests p > Data bank 2 
Data bank 3 Data bank 3 
Tag bank 0 Tag bank 1 
Figure 7-1 L2 cache bank structure 
7.2.2 Strictly-enforced inclusion property with L1 data caches 


The L2 memory system requires support for inclusion between the L1 data caches and the L2 cache. A 
line that resides in any of the L1 data caches must also reside in the L2 cache. However, the data can 
differ between the two caches when the L1 cache line is in a dirty state. If another agent, a core in the 
cluster or another cluster, accesses this line in the L2 then it knows the line is present in the L1 of a 
processor and then it queries that core for the most recent data. 


This strictly-enforced inclusion property has the following benefits: 

e Any AXI or CHI ReadClean operation that results in a line being in shared state in the L1 data caches 
can be returned from the L2 cache. This yields the highest performance for delivering data to a core. 

e When powering down the processor, it reduces the time to clean and invalidate the entire L1 data 
cache. 
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7.2.3 Enabling and disabling the L2 cache 


For processor requests, the L2 cache is enabled when the C bit of the SCTLR register is enabled. The 
cache attributes are provided with each request, taking into account the page attributes that the MMU 
page tables provided and overriding these attributes if the corresponding cache enable bit in the SCTLR 
is disabled. 


To enable the L2 cache to cache both instructions and data following the reset sequence, you must: 


1. Complete the processor reset sequence. 

2. Enable L2 ECC, if present and required, by programming bit[21] of the L2 Control Register. 
3. Program the I bit and C bit of the SCTLR. 

To disable the L2 cache, you must use the following sequence: 

1. Disable the C bit. 

2. Clean and invalidate the L1 and L2 caches. 


For ACP requests, the L2 cache is enabled if the request uses Normal Write-Back memory attributes. The 
processor searches the L2 cache to determine if the request is valid before allocating the line for Normal 
Write-Back Read-Write-Allocate memory. 


Related information 
4.5.5 System Control Register on page 4-242. 
4.3.58 L2 Control Register, EL1 on page 4-168. 


7.2.4 Error Correction Code 


The L2 cache supports optional ECC in most of its memories. For core instruction and data accesses 
resulting in an L2 cache hit, where a single-bit error is detected on the Data array, the L2 memory system 
supports in-line ECC correction. Uncorrected data is forwarded to the requesting unit, and in parallel, the 
ECC circuitry checks for accuracy. If a single-bit error is detected, any uncorrected data returned within 
two cycles before the error indicator must be discarded. The L2 memory system begins to stream 
corrected data to the requestor. 


When there is no data transfers, the L2 memory system shifts back to return uncorrected data until it 
detects the next single-bit error. Forwarding uncorrected data can be disabled by programming bit[20] of 
the L2 Control Register. This avoids the requirement to flush requests associated with single-bit ECC 
errors on L2 cache hits, but adds an additional 2 cycles to the L2 hit latency. 


For all other single-bit ECC errors detected, the request is flushed from the L2 pipeline and is forced to 
reissue. The tag bank where the single-bit error occurred, performs a read-modify-write sequence to 
correct the single-bit error in the array. The request is then reissued. 


Related information 
4.3.68 CPU Memory Error Syndrome Register, EL1 on page 4-209. 


7.2.5 Register slice support for large cache sizes 


As the L2 cache size is increased, the area of the implementation increases. This increase adds significant 
route delays to and from the RAM memories. This increase can impact the maximum frequency of the 
implementation. 


To counter this, you can insert register slices before and after the RAM memories to offset the longer 
route delays. This enables the frequency target of the implementation to remain high. Additional slices 
can impact the overall L2 hit latency but they can enable requests to be streamed in a more efficient 
manner. You can increase the programmed latency values of the RAMs to cover the additional route 
delays without adding the slices. However, this method has an impact on performance because requests 
cannot be streamed as efficiently. 
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The L2 RAMs support one inserted register slice. Each register slice introduces a pair of registers, one 
before the RAM and one after the RAM. 


Bits[12] and [10] of the CP15 L2 Control Register, L2CTLR, indicate the presence of RAM register 
slices in the design. In addition, the L2CTLR contains bits to program the setup and latency for the L2 
Tag and Data RAMs. 


Overall RAM latency calculation 


The RAM latency is a function of the following: 


e Programmed latency in the L2 Control Register. 
e Additional strobe clock setup required value in the LZCTLR. 


RAM latency = programmed value + strobe setup. 

The RAM latency determines the rate at which back to back operations to the RAM can be scheduled. 
The total effective latency = RAM latency + 2xN, where N is the number of register slices to insert. 
The slices are considered pipeline registers and do not affect the throughput rate of RAM accesses. 


The following table shows the total effective L2 Tag latency with the register slice and setup factored in. 


Table 7-1 Total effective L2 Tag latency with slice and setup factored in 





L2CTLR[8:6] register bits Total effective Tag latency 





Tag slice =0 Tagslice=0 Tagslice=1 Tag slice =1 


Tag setup =0 Tag setup =1 Tag setup =0 Tag setup =1 























000% 2 3 4 5 

001 2 3 4 5 

010 3 4 5 5 

011 4 5 5 5 

100 5 5 5 5 

Ixx, >4 5 5 5 5 
Note 





e The total effective L2 Tag latency is set to a maximum of 5 cycles. 

e Each tag slice adds 2 cycles and affects the L2 Tag, Snoop Tag, Dirty, and Inclusion PLRU RAMs. 

e Setting tag setup to 1 adds 1 cycle. 

e Slice and setup have priority over programmed latency in determining the total effective L2 Tag 
latency. 





The following example shows a Tag RAM access with 3 cycles total effective Tag latency. 





do This is the reset value. 
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Example 7-1 Examples 





Tag RAM access with 3 cycles total latency 
When tag slice = 0, LACTLR[9] = 0, L2CTLR[8:6] = 0b018, the following applies: 
e No slice cycle. 
e No setup cycle. 
*« 3 cycles Tag RAM access. 
e 3 cycles total effective Tag latency. 


The following example shows a Tag RAM access with 4 cycles total effective Tag latency. 


Example 7-2 Examples 





Tag RAM access with 4 cycles total latency 
When tag slice = 0, LACTLR[9] = 1, L2CTLR[8:6] = 0b018, the following applies: 
e No slice cycle. 
e 1 setup cycle. 
e 4cycles Tag RAM access (Programmed + Setup). 
e 4 cycles total effective Tag latency. 





The following example shows a Tag RAM access with 5 cycles total effective Tag latency. 


Example 7-3 Examples 





Tag RAM access with 5 cycles total latency 
When tag slice = 1, L2ACTLR[9] = 1, L2CTLR[8:6] = 0b018, the following applies: 
e 2 slice cycles. 
e 1 setup cycle. 
e 3 cycles Tag RAM access (Programmed + Setup, capped to 3 because of slices). 
e 5 cycles total effective Tag latency. 





The following table shows the total effective L2 Data latency with the register slice and setup factored in. 


Table 7-2 Total effective L2 Data latency with slice and setup factored in 





L2CTLR[2:0] register Total effective Data latency 


bits 





Data slice =0 Dataslice=0 Dataslice=1 Dataslice=1 Dataslice=2 Data slice =2 


Data setup =0 Data setup =1 Data setup =0 Data setup =1 Data setup =0 Data setup =1 























000%? 2 3 4 5 6 7 
001 2 3 4 5 6 7 
010 3 4 5 6 7 8 
oll 4 5 6 6 8 8 
dp This is the reset value. 
ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. 7-303 


Non-Confidential 


7 Level 2 Memory System 
7.2 Cache organization 


Table 7-2 Total effective L2 Data latency with slice and setup factored in (continued) 





L2CTLR[2:0] register Total effective Data latency 
bits 





Data slice =0 Dataslice=0 Dataslice=1 Data slice =1 Dataslice=2 Data slice =2 


Data setup =0 Data setup =1 Data setup =0 Data setup =1 Data setup =0 Data setup =1 





100 5 6 6 6 8 8 





101, 11x >=5 6 6 6 6 8 8 





Note 


¢ The total effective L2 Data latency is set to a maximum of 8 cycles for configurations supporting 
Data slice=2, otherwise the maximum is set to 6 cycles. 

e Each data slice adds 2 cycles and affects the L2 data and data ECC RAMs. 

e Setting data setup to | adds 1 cycle. 

e Slice and setup have priority over programmed latency in determining the total effective L2 Data 
latency. 








The following example shows a Data RAM access with 4 cycles total effective Data latency. 


Example 7-4 Data RAM access with 4 cycles total latency 





When data slice = 0, L2ACTLR[5] = 0, L2CTLR[2:0] = @b011, the following applies: 
e No slice cycle. 

e No setup cycle. 

e 4 cycles Data RAM access. 

e 4 cycles total effective Data latency. 





The following example shows a Data RAM access with 5 cycles total effective Data latency. 


Example 7-5 Data RAM access with 5 cycles total latency 





When data slice = 0, L2CTLR[5] = 1, L2CTLR[2:0] = b011, the following applies: 
e No slice cycle. 

e 1 setup cycle. 

e 5 cycles Data RAM access (Programmed + Setup). 

e 5 cycles total effective Data latency. 





The following example shows a Data RAM access with 6 cycles total effective Data latency. 


Example 7-6 Data RAM access with 6 cycles total latency 





When data slice = 1, L2CTLR[5] = 1, L2CTLR[2:0] = b011, the following applies: 

e 2 slice cycles. 

e 1 setup cycle. 

e 4 cycles Data RAM access (Programmed + Setup, capped to 4 due to register slices). 
e 6 cycles total effective Data latency. 
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The following example shows a Data RAM access with 8 cycles total effective Data latency. 


Example 7-7 Data RAM access with 8 cycles total latency 





When data slice = 2, LACTLR[5] = 1, L2CTLR[2:0] = b011, the following applies: 

e 4 slice cycles. 

e 1 setup cycle. 

e 4cycles Data RAM access (Programmed + Setup, capped to 4 due to register slices). 
e 8 cycles total effective Data latency. 





Related information 
4.3.58 L2 Control Register, EL1 on page 4-168. 


Related information 
4.5.5 System Control Register on page 4-242. 
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7.3 L2 RAM memories 


The L2 memory system contains several RAM memories that support optional ECC or parity error 
detection mechanisms. 


Any RAM memory that uses ECC support can perform single-bit error correction and double-bit error 
detection. Contents of the RAM memories with parity support can invalidate entries if a parity error is 
detected because this data is associated with read-only structures. 


The following table shows all RAM memories contained in the L2 memory system. 


Table 7-3 L2 RAM memories 

















RAM memory ECC or Parity 
L2 Tag RAM ECC 
L2 Snoop Tag RAM ECC 
L2 Data RAM ECC 
L2 Dirty RAM ECC 





L2 Inclusion PLRU RAM ECC 
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L2 cache prefetcher 


The Cortex-A72 processor includes a hardware L2 prefetcher that handles prefetch generation for 
instruction fetch and TBW descriptor accesses. 





Note 


The Load/store unit handles prefetch generation for Load/store accesses targeting both the L1D cache 
and L2 cache. 





Some of the key features are: 


e Software-programmable prefetches on any instruction fetch L2 miss of 0, 1, 2, or 3 prefetches. All 
prefetches are allocated into the L2 cache. 

e Separate mechanisms to detect and prefetch: 
— Instruction fetch streams, to fetch consecutive cache lines on an L2 instruction fetch access. 
— Table walk descriptor, to fetch the consecutive cache line on an L2 table walk descriptor access. 





Note 


The prefetcher is limited to prefetch within the 4KB page of the current request, if the page has been 
mapped at a 4KB granularity. 





¢ Support for forwarding from prefetched requests. If a read request was sent over AXI because of a 
prefetch request, and a demand access for the same line was received, the read data can be forwarded 
from the internal data buffers to the demand request, before waiting for the line to be allocated to the 
cache. 


You can program the CPUECTLR register to indicate the maximum number of prefetches to be allocated 
in the PRQ on the following: 


e An instruction fetch miss in the L2 cache by programming CPUECTLR_EL1[36:35]. 


The programmed distance is also used as the skip distance for any instruction fetch read with a stride 
match that hits in the L2 cache. In these cases, a single prefetch request is allocate in the PRQ as: 
prefetch address = current address + (stride x programmed distance) 

Note 


The stride for an instruction fetch access is always one cache line. 
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7.5 Cache coherency 


The SCU uses hybrid Modified Exclusive Shared Invalid (MESI) and Modified Owned Exclusive Shared 
Invalid (MOESI) protocols to maintain coherency between the individual L1 data caches and the L2 
cache. 


The L1 data caches support the MESI protocol. The L2 memory system contains a Snoop Tag array that 
is a duplicate copy of each of the L1 data cache directories. The Snoop Tag array reduces the amount of 
snoop traffic between the L2 memory system and the L1 memory system. Any line that resides in the 
Snoop Tag array in the Modified/Exclusive state belongs to the L1 memory system. Any access that hits 
against a line in this state must be serviced by the L1 memory system and passed to the L2 memory 
system. If the line is invalid or in the shared state in the Snoop Tag array, then the L2 cache can supply 
the data. 


The SCU contains buffers that can handle direct cache-to-cache transfers between processors without 
reading or writing any data on the ACE or CHI interface. Lines can migrate back and forth without any 
change to the MOESI state of the line in the L2 cache. 


Shareable transactions on the optional ACP are also coherent, so the Snoop Tag arrays are queried as a 
result of ACP transactions. For reads where the Shareable line resides in one of the L1 data caches in the 
Modified/Exclusive state, the line is transferred from the L1 memory system to the L2 memory system 
and passed back on the ACP. 
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7.6 Asynchronous errors 
The L2 memory system has two outputs that indicate asynchronous error conditions. 


An asynchronous external error condition exists when either: 
¢ The nEXTERRIRQ output is LOW. 
e The nINTERRIRQ output is LOW. 


If an asynchronous error condition is detected, the corresponding bit in the L2 Extended Control Register 
is asserted. The asynchronous error condition can be cleared by writing @b@ to the corresponding bit of 
the LZECTLR. Software can only clear the LZECTLR. Any attempt to assert the error by writing the 
L2ECTLR is ignored. 


Any external error associated with a load instruction is reported back to the requestor along with an error 
response and this might trigger an abort. Any external error associated with a Device, Non-cacheable, or 
non-allocating write that misses in the L2, or a cache maintenance operation is reported to the core that 
issued the transaction through a processor-specific interrupt request to the GIC. 


Related information 
4.3.59 L2 Extended Control Register, ELI on page 4-172. 
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7.7 External coherent interfaces 


The Cortex-A72 processor provides configurable options for either AMBA4 AXI Coherency Extensions 
(ACE) or CHI interconnect architectures. 


Each interface option provides a 128-bit wide data interface to the system and supports 1:1 clock ratios 
with respect to the processor clock and N:1, integer multiple clock ratios, of the core clock. 


Note 





ACE is supported with the following restriction: 
e ARQOS and AWQOS signals are not present. 





This section contains the following subsections: 


e 7.7.1 L2 memory interface attributes on page 7-310. 

¢ 7.7.2 Interface modes on page 7-311. 

e 7.7.3 Snoop filter support on page 7-312. 

¢ 7.7.4 Distributed virtual memory transactions on page 7-312. 
e 7.7.5 External memory attributes on page 7-312. 

¢ 7.7.6 ACE ARID and AWID assignment on page 7-313. 

e 7.7.7 CHI LPID assignment on page 7-314. 

¢ 7.7.8 ACE supported transfers on page 7-314. 

e 7.7.9 CHI link layer flow control on page 7-315. 

¢ 7.7.10 CHI DVM acceptance capability on page 7-315. 

e 7.7.11 L2 Auxiliary Control Register settings on page 7-315. 


7.7.1 L2 memory interface attributes 


The following table shows the L2 memory interface attributes for the processor. The table lists the 
maximum possible values for the read and write issuing capabilities. 


Table 7-4 L2 memory interface attributes 

















Attribute Value Description 
Write issuing 16 16 outstanding writes supported that can be evictions, single writes, or write bursts of any 
capability memory type. 
Read issuing 19, 23, or 27 Ifthe core implements: 
capability 20-entry FEQ 19 outstanding reads supported that can be line fills, single reads, or read bursts 
of any memory type. 
24-entry FEQ 23 outstanding reads supported that can be line fills, single reads, or read bursts 
of any memory type. 
28-entry FEQ 27 outstanding reads supported that can be line fills, single reads, or read bursts 
of any memory type. 
Snoop acceptance 20 Up to 20 outstanding snoop requests are accepted on the AC channel in response to those 
capability requests on the CR channel. 
DVM issuing 38, 46, or 54 Ifthe processor implements: 
capability 


20-entry FEQ 38 DVM Message transactions supported (19 two-part messages) 
24-entry FEQ 46 DVM Message transactions supported (23 two-part messages) 
28-entry FEQ 54 DVM Message transactions supported (27 two-part messages) 
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7.7.2 Interface modes 


The ACE and CHI coherent interconnect interfaces can be configured through input signals to change the 
interface behavior. The multiprocessor implements the following configuration signals: 

e SYSBARDISABLE on page 7-311. 

e BROADCASTINNER on page 7-311. 

e BROADCASTOUTER on page 7-311. 

e BROADCASTCACHEMAINT on page 7-312. 


SYSBARDISABLE 


SYSBARDISABLE controls issuing barrier transactions on the coherent interconnect. 


When SYSBARDISABLE is deasserted, barriers are broadcast on the coherent interconnect as a 
Memory Barrier or Synchronization Barrier for an ACE interface, or an EOBarrier or ECBarrier for a 
CHI interface. 


When SYSBARDISABLE is asserted, barriers are not broadcast on the coherent interconnect. Barriers 
are enforced internally to the Cortex-A72 processor by observing completion of transactions through the 
Read data channel and Write response channel for an ACE interface, or the RXDAT data channel and 
RXRSP response channel for a CHI interface. Systems that use this mode must ensure that ACE write 
responses or CHI RXRSP completion responses guarantee that the transaction has been globally 
observed and that barrier broadcasts are not required for any other system functionality. 


For ACE configurations that require AXI3 compatibility you must: 
e Assert SYSBARDISABLE. 

e Deassert BROADCASTINNER. 

e Deassert BROADCASTOUTER. 

e Deassert BROADCASTCACHEMAINT. 


BROADCASTINNER 


BROADCASTINNER controls issuing coherent transactions targeting the Inner Shareable domain on 
the coherent interconnect. When BROADCASTINNER is asserted, the processor is considered to be 
part of an Inner Shareable domain that extends beyond the processor and any transaction that requires 
coherency with other masters in this domain is broadcast on the ACE or CHI interface. 


When BROADCASTINNER is asserted, BROADCASTOUTER must also be asserted. In this 
configuration, coherent masters can share memory in the Inner or Outer Shareable domains. 


When BROADCASTINNER is deasserted, the processor does not issue DVM requests on the ACE AR 
channel or CHI TXREQ channel. 


BROADCASTOUTER 


BROADCASTOUTER controls issuing coherent transactions targeting the outer shareability domain on 
the coherent interconnect. When BROADCASTOUTER is asserted, the processor is considered to be 
part of the Outer Shareable domain and any transaction that requires coherency with other masters in this 
domain is broadcast on the ACE or CHI interface. 


It is possible to assert BROADCASTOUTER without asserting BROADCASTINNER. This selects a 
configuration that limits coherent masters to sharing memory only in the outer shareability domain. 
However, cores within the cluster can still share memory in the Inner Shareable domain. 


When BROADCASTOUTER is deasserted, BROADCASTINNER must also be deasserted. 
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When BROADCASTINNER and BROADCASTOUTER are both deasserted, the processor does not 
issue coherent read or write requests on the ACE AR and AW channels, or the CHI TXREQ channel. 


BROADCASTCACHEMAINT 


BROADCASTCACHEMAINT controls issuing cache maintenance transactions, such as CleanShared, 
CleanInvalid and MakelInvalid, on the coherent interconnect. When BROADCASTCACHEMAINT is 
asserted, cache maintenance instructions might cause cache maintenance transactions on ACE or CHI 
interconnect. The cache maintenance transactions are broadcast even if the memory location is Non- 
shareable or when the BROADCASTINNER or BROADCASTOUTER signals normally prevent such 
a broadcast. This configuration allows the management of an external L3 cache that might cache Non- 
shareable data. 


When BROADCASTCACHEMAINT is deasserted, only those cache maintenance transactions 
required for coherency as determined by Inner and Outer shareability and the BROADCASTINNER 
and BROADCASTOUTER signals are issued on the coherent interconnect. 


Systems that utilize a L3 cache that supports caching of Non-shareable memory must assert 
BROADCASTCACHEMAINT. 


7.7.3 Snoop filter support 


In general, the processor can issue a Write-Back, WriteEvict, or an Evict transaction for any cache line 
that is removed from the L2 cache. You can use these messages to manage an external snoop filter. 
However, the snoop filter logic must not depend on such a message for every clean line dropped from the 
processor caches, because in some circumstances the processor might not signal an eviction. For 
example, clean evictions are not guaranteed to occur in cases involving L1 or L2 tag ECC errors. 


7.7.4 Distributed virtual memory transactions 


In a system where the processor can receive a Distributed Virtual Memory (DVM) synchronization 
message over the AXI master snoop address channel, BRESP for any write transaction must not be 
asserted to the core until all AXI masters that might have initiated the DVM synchronization request 
observe the transaction. 

Note 


The Cortex-A72 processor does not support a multi-part DVM hint message. 








7.7.5 External memory attributes 


The Cortex-A72 processor uses a combination of inner and outer memory attributes from the MMU to 
determine how its memory system handles each combination. Table 6-1 Memory attribute combinations 
on page 6-290 shows the Inner and Outer memory attributes used by the L1 and L2 caches to form the 
internal memory types. Table 7-5 External memory attributes on page 7-313 shows how these attributes 
are used to form the external memory type presented on ARCACHE, AWCACHE, or 
TXREQFLIT[MemAttr]. 
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Table 7-5 External memory attributes 





Outer MemAttr 


Inner MemAttr External memory type 


ARCACHE AWCACHE TREQFLIT[MemAittr] 
























































Device nGnRnE Strongly-ordered e@be0e8e ebeeee 0be010 
Device nGnRE Device @bee01 @bee0e01 @bee011 
Device nGRE Device @bee001 0b0001 @bee11 
Device GRE Device @be001 @beee01 @bee11 
Non-cacheable Non-cacheable Non-cacheable Bufferable @b0011 @bee11 @beee1 
Non-cacheable Write-Through Non-cacheable Bufferable @bee11 @bee11 0b0001 
Non-cacheable Write-Back Non-cacheable Bufferable 0b0011 0b0011 0b0001 
Write-Through Non-cacheable Non-cacheable Bufferable @bee11 @bee11 @beee1 
Write-Through Write-Through Non-cacheable Bufferable @b0011 @bee11 @bee0e1 
Write-Through Write-Back Non-cacheable Bufferable 0b0011 @bee11 @beee1 
Write-Back Non-cacheable | Non-cacheable Bufferable @be011 @bee11 @beee1 
Write-Back Write-Through Non-cacheable Bufferable @be011 @bee11 @beee1 
Write-Back No-Allocate Write-Back Write-Back No-Allocate @b1011 0b0111 0b0101 
Write-Back Read-Allocate Write-Back Write-Back Read-Allocate @b1111 0b0111 0b1101 
Write-Back Write-Allocate Write-Back Write-Back Write-Allocate 0b1011 0b1111 0b1101 
Write-Back Read-Write- Write-Back Write-Back Read-Write- @b1111 @b1111 @b1101 


Allocate 


Allocate 





7.7.6 


In addition to ARCACHE, AWCACHE, and TXREQFLIT[MemAttr] the processor also presents the 
raw outer memory attributes, inner memory type, and Inner and Outer Shareable on dedicated external 
interface signals RUDMEMATTR, WRMEMATTR, and REQMEMATTR corresponding to 
transactions on ACE read channel, ACE write channel and CHI TXREQ channel, respectively. 


Related information 
A.9 CHI interface signals on page Appx-A-543. 
A.10 ACE interface signals on page Appx-A-548. 


ACE ARID and AWID assignment 


When the system issues multiple requests on the AR channel with the same ARID, or on the AW channel 
with the same AWID, it must follow the appropriate ordering rules as described in the ARM® AMBA” AXI 
and ACE Protocol Specification. 


For certain transactions, the system must be able to identify which core generated the request. This 
applies to requests affecting the global exclusive monitor in addition to Strongly-ordered or Device 
memory type accesses to peripherals. 


ARCACHEMYJ3:0] and AWCACHEM[3:0] identify whether the memory types are Strongly-ordered or 
Device. See the ARM® AMBA” AXI and ACE Protocol Specification. For these memory types, if 
ARIDM[2] or AWIDM[2] is LOW, then the request is generated from one of the cores. ARIDM[1:0] or 
AWIDM[1:0] indicate which core generated the request. If ARIDM[2] or AWIDM[2] is HIGH, the 
request originates from the master connected to the optional ACP slave port. 


For an exclusive read transaction such as ARLOCK asserted, ARID[1:0] indicates which core generated 
the request. Only cores can generate exclusive read requests, and not the ACP or any other source. 
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For an exclusive write transaction such as AWLOCK asserted, AWID[1:0] indicates which core 
generated the request. Only cores can generate exclusive write requests, and not the ACP or any other 
source. 


The system must not rely on specific values of ARID or AWID that correspond with specific transaction 
sources or transaction types other than the information described in this section. 


7.7.7 CHI LPID assignment 


CHI TXREQ transactions include the Logical Processor ID (LPID) field. This field uniquely identifies 
the logical core that generated the request transaction. 


The processor uses the following LPID values: 


e@beee Core 0 request. 

@bee1 Core 1 request. 

0be10 Core 2 request. 

@be11 Core 3 request. 

@b100 ACP request. 

@b111 L2 hardware flush request. 


Secondary transactions such as copybacks from the L2, because of cache fills caused by core or ACP 
access L2 misses, use the LPID of the request that caused the copyback. 


7.7.8 ACE supported transfers 


For Normal Inner-Cacheable memory transfers initiated from one of the Cortex-A72 processors, the 
following transfers are supported on the ACE: 


e WRAP 4x 128-bit read transfers. 
e WRAP 4x 128-bit write transfers. 


For Normal Non-Cacheable memory transfers initated from one of the Cortex-A72 processors, the 
following transfers are supported on the ACE: 


e WRAP 4x 128-bit read transfers. 
e WRAP 4x 128-bit write transfers. 
e INCR 1x 128-bit read transfers. 

e INCR 1x 128-bit write transfers. 


For Strongly-ordered or Device transactions initiated from one of the Cortex-A72 processors, the 
following transfers are supported on the ACE: 


INCR 1x 8-bit read transfers. 

INCR 1x 16-bit read transfers. 

INCR 1x 32-bit read transfers. 

INCR 1x 64-bit read transfers. 

INCR N (N:1 or 4) 128-bit read transfers. 
INCR 1x 8-bit write transfers. 

INCR 1x 16-bit write transfers. 

INCR 1x 32-bit write transfers. 

INCR 1x 64-bit write transfers. 

INCR N (N:1 or 4) 128-bit write transfers. 








The following table describes the use of the burst types for Non-Cacheable and Cacheable but not 
allocated memory attributes. 
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Table 7-6 Use of WRAP and INCR burst types for Non-Cacheable and Cacheable but not allocated transactions 





Burst type Used by 





WRAP e Non-Cacheable read transactions, excluding tablewalk or exclusive accesses. 
e Cacheable but not allocated read transactions initiated from one of the Cortex-A72 processors issued on AR-channel. 





INCR e Non-cacheable tablewalk and exclusive read transactions. 
e Non-Cacheable or Cacheable but not allocated write transactions initiated from one of the Cortex-A72 processors 
issued on AW-channel. 





If there are requests on the ACP interface, the following transfers can be generated on the ACE if 
comparable requests are received on the ACP: 

e WRAP N 4x 128-bit read transfers. 

e WRAP 4x 128-bit write transfers. 

e INCR 1x 128-bit read transfers. 

e INCR 1x 128-bit write transfers. 


7.7.9 CHI link layer flow control 


CHI link layer flow control uses a counter on each link to track the number of outstanding link layer 
credits. The Cortex-A72 processor can receive a maximum of 15 link-layer credits on the TXREQ, 
TXRSP, and TXDAT links and issues a maximum of nine link layer credits on the RXSNP, RXRSP, and 
RXDAT links. 


7.7.10 CHI DVM acceptance capability 


The Cortex-A72 processor can have a maximum of four outstanding DVM transactions on its snoop 
interface. When this limit is reached, the system cannot send any more DVM transactions on the RXRSP 
link until the processor has provided a response to an older DVM transaction on the TXRSP link 


7.7.11 L2 Auxiliary Control Register settings 


This section describes the recommended performance settings for the Cortex-A72 L2 Auxiliary Control 
Register in various system configurations. 


Evict transactions 


Evict and WriteEvict transactions indicate that a shareable cache line has been evicted from the master's 
local caches. The downstream snoop filter can use this information to update its directory to indicate that 
the issuing master no longer contains a copy of the cache line. 


WriteEvict carries data and can be used to allow allocation into a system or Level 3 cache. In general, 

ARM recommends the following: 

e A system that contains a snoop filter enables Evict transactions. 

e A system that contains a L3 cache that wants to behave like a victim cache for cache lines in the 
Unique state enables WriteEvict transactions. 


The Cortex-A72 L2ZACTLR_EL] register contains bits that can enable or disable Evict and WriteEvict 
transactions individually. See LZAACTLR_EL1[3] and LZAACTLR_EL1[14], respectively, in the L2 
Auxiliary Control Register, EL1. 


When the Cortex-A72 processor is used with the ARM CCI-400 in an ACE-based system, ARM 
recommends that you set LZACTLR_EL1[3] to 1 to disable Evict transactions. The reset value of 
L2ACTLRJ3] is 0 in Cortex-A72 ACE configurations. WriteEvict transactions are disabled by default in 
Cortex-A72 ACE configurations. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 7-315 
Non-Confidential 


7 Level 2 Memory System 
7.7 External coherent interfaces 


When the Cortex-A72 processor is used with the ARM CCN-504 in a CHI-based system, no change is 
required from the default reset value of L2ACTLR_EL1. By default, Cortex-A72 CHI configurations 
generate WriteEvict transactions for allocating into the CCN-504 L3 cache but do not generate Evict 
transactions because the CCN-504 snoop filter does not require them. 


WriteUnique and WriteLineUnique transactions 


If the Cortex-A72 processor is implemented in an ACE-based system that does not contain a snoop filter, 
enabling WriteUnique and WriteLineUnique transactions might provide a small increase in system 
performance. To enable WriteUnique and WriteLineUnique transactions, clear LAACTLR_EL1[4]. The 
reset value of L2ACTLR[4] is 1. 


If the Cortex-A72 processor is implemented in an ACE-based system that does contain a snoop filter or 
in a CHI based system, no change is recommended from the default value. 


Related information 
L2 Auxiliary Control Register, EL1. 
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The optional Accelerator Coherency Port (ACP) is implemented as an AXI4 slave interface with the 
following restrictions: 


128-bit read and write interfaces. 

ARCACHE and AWCACHE are restricted to Normal, Write-Back, Read-Write-Allocate, Read- 
Allocate, Write-Allocate, and No-Allocate memory. ARCACHE and AWCACHE are limited to the 
values @b@111, @b1011, and @b1111. Other values cause a SLVERR response on RRESP or BRESP. 
Exclusive accesses are not supported. 

Barriers are not supported. BRESP indicates global observation of all writes. 

ARSIZE and AWSIZE signals are not present and assume a value of @b100,16 bytes. 

ARBURST and AWBURST signals are not present and assume a value of INCR. 

ARLOCK and AWLOCK signals are not present. 

ARQOS and AWQOS signals are not present. 

ARLEN and AWLEN are limited to values 0 and 3. 


This section contains the following subsections: 


7.8.1 Transfer size support on page 7-317. 
7.8.2 ACP ARUSER and AWUSER signals on page 7-317. 


7.8.1 Transfer size support 


ACP supports the following read-request transfer size and length combinations: 


64-byte INCR request characterized by: 

— ARLEN is 0x03, 4 beats. 

— ARADDR aligned to 64-byte boundary, so ARADDR[5:0] is 0b00 0000. 
— ARSIZE and ARBURST assume values of @b1@0 and INCR respectively. 
16-byte INCR request characterized by: 

— ARLEN is 0x80, | beat. 

— ARADDR aligned to 16-byte boundary, so ARADDR[3:0] is exe. 


ACP supports the following write-request transfer size and length combinations: 


64-byte INCR request characterized by: 

— AWLEN is 0x03, 4 beats. 

— AWADDR aligned to 64-byte boundary, so AWADDRJ5:0] is @bee 0000. 

— AWSIZE and AWBURST assume values of @b10@ and INCR respectively. 

— WSTRB for all beats must be the same and either all asserted or all deasserted. 
16-byte INCR request characterized by: 

— AWLEN is 0x09, | beat. 

— AWADDR aligned to 16-byte boundary, so AWADDRJ3:90] is exe. 

— AWSIZE and AWBURST assume values of @b10@ and INCR respectively. 

— WSTRB can take any value. 


Requests not meeting these restrictions cause a SLVERR response on RRESP or BRESP. 


7.8.2 ACP ARUSER and AWUSER signals 


ACP transactions can cause coherent requests to the system. Therefore ACP requests must pass the Inner 
and Outer Shareable attributes to the L2. To pass the Inner Shareable attribute, use ARUSER[0] and 
AWUSERJ0]. To pass the Outer Shareable attribute, use ARUSER[1] and AWUSER[1]. 


The setting of AxXUSER[1:0] to @b11 is not allowed and causes a SLVERR response. 
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Chapter 8 
Generic Interrupt Controller CPU Interface 


This section describes the Cortex-A72 processor implementation of the GIC CPU interface. 


It contains the following sections: 

e 8.1 About the GIC on page 8-319. 

¢ 8.2 GIC functional description on page 8-320. 
e 8.3 GIC programmers model on page 8-325. 
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8.1 About the GIC 


The GIC is a resource for supporting and managing interrupts in a cluster system. 


It implements the GIC CPU interface and provides: 


Registers for managing: 

— Interrupt sources. 

— Interrupt behavior. 

— Interrupt routing to one or more processors. 


The GIC supports: 


Two Security states. 

Interrupt virtualization. 

Software-generated Interrupts (SGIs). 

System Error Interrupts (SEIs). 

Message-based interrupts. 

System register access. 

Memory-mapped register access. 

Interrupt masking and prioritization. 

Interrupt routing based on processor affinity, in multiprocessor environments. 
Interrupt routing based on specifying target processors. 
Wake-up events in power-management environments. 


The GIC includes interrupt grouping functionality that supports: 


Configuring each interrupt to belong to an interrupt group. 

Signaling Group | interrupts to the target processor using either the IRQ or the FIQ exception 
request. 

Signaling Group 0 interrupts to the target processor using the FIQ exception request only. 

A unified scheme for handling the priority of Group 0 and Group 1 interrupts. 


The Cortex-A72 processor implements the GIC CPU interface as described in the Generic Interrupt 


Controller (GICv3) architecture. It can interface with a GICv3 Distributor component in the system. 


This chapter only describes features that are specific to the Cortex-A72 processor implementation. 
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8.2 GIC functional description 
Provides a functional description of the GIC. 


The GIC is a single functional unit in the Cortex-A72 processor. The GIC consists of a common block 
and several CPU interface blocks. For each core in the system, there is: 

e A CPU interface. 

e A virtual interface control block. 

e A virtual CPU interface. 


This section contains the following subsections: 

e 8.2.1 GIC memory map on page 8-320. 

e 8.2.2 Interrupt sources on page 8-322. 

e 8.2.3 Interrupt priority levels on page 8-322. 
¢ 8.2.4 GIC bypass modes on page 8-323. 

e 8.2.5 nIRQ and nVFIQ inputs on page 8-323. 


8.2.1 GIC memory map 


The GIC registers are memory-mapped, with a physical base address specified by 
PERIPHBASE[43:18]. This input must be tied to a constant value. The PERIPHBASE value is 
sampled during reset into the Configuration Base Address Register (CBAR) for each processor in the 
MPCore device. 


The GIC registers are grouped into three contiguous 64KB pages. These blocks include the CPU 
interface, virtual interface control, and virtual CPU interface blocks. 


Memory regions used for these registers must be marked as Device, nGnRnE, nGnRE, nGRE, or GRE in 
the translation tables. Memory regions marked as Normal memory cannot access any of the GIC 
registers, but can access caches or external memory as required. 


Access to these registers must be with the single word load and store instructions. Load/store-multiple, 
load/store-double, and load/store exclusive instructions result in a Data Abort exception to the requesting 
processor. 


The Accelerator Coherency Port (ACP) cannot access any of the GIC registers. The registers must be 
accessed through one of the processors. Any access from ACP to the GIC registers goes to external 
memory and no Data Abort exception is generated. 


The following table shows the GIC memory map of a Cortex-A72 processor. An external standalone GIC 
such as the ARM GIC-400 or other proprietary GIC might differ. 


The following table shows the GIC memory map of a Cortex-A72 processor. An external standalone GIC 
such as the ARM GIC-400 or other proprietary GIC might differ. It lists the address offsets for the GIC 
blocks relative to the PERIPHBASE base address. 


Table 8-1 Cortex-A72 processor GIC memory map 





Offset range from PERIPHBASE[43:18] GIC block 


























0x00000-0xO1FFF CPU interface 
Qx@2000-OxOF FFF Reserved 
0x10000-0x10F FF Virtual interface control 
@x11000-0x1F FFF Reserved 
Qx20000-0x21FFF Virtual CPU interface (4KB page offset) 
@x22000-Ox2EFFF Reserved 
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Table 8-1 Cortex-A72 processor GIC memory map (continued) 





Offset range from PERIPHBASE[43:18] GIC block 





Qx2FQ00-Ox30F FF Alias of the Virtual CPU interface (64KB page offset alias) 





@x31FFF-Ox3FFFF Reserved 





Related information 
4.3.70 Configuration Base Address Register, ELI on page 4-212. 
4.5.24 Configuration Base Address Register on page 4-274. 
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The GIC CPU interface receives interrupts on the following signals: 


nSEI, nREI, These signals generate System Error Interrupts (SEIs). 


nVSEI 


nIRQ, nFIQ When the GIC CPU interface is in bypass mode, these signals provide legacy IRQ and 
FIQ inputs to the processor. 


nVIRQ, 
nVFIQ 
AMBA 
AXI4 
Stream 
interface 


These signals enable an external source to generate virtual IRQ and FIQ interrupts. 


GICv3 interrupt messages that are sent by an external Distributor. Each interrupt message 
has a unique interrupt ID. 


The interrupt message types are: 


Local 
Peripheral 
Interrupts (LPIs) 
Private 
Peripheral 
Interrupts (PPIs) 
Shared 
Peripheral 
Interrupts 
(SPIs). 

Software 
Generated 
Interrupts 
(SGIs) 


System Error 
Interrupts (SEIs) 


Virtual Local 
Peripheral 
Interrupts 
(vLPIs) 


Related information 
A.5 GIC CPU interface signals on page Appx-A-535. 


8.2.3 Interrupt priority levels 


An interrupt generated by a peripheral that is destined for one or more 
processors within a specific affinity hierarchy. 


An interrupt generated by a peripheral that is specific to a single 
processor. All PPIs must connect directly to the external Distributor. 


An interrupt generated by a peripheral that is destined for one or more 
processors. All SPIs must connect directly to the external Distributor. 


SGIs are generated by: 

e Writing to the ICC_SGIOR, ICC_SGIIR, or ICC_ASGIIR 
registers in the CPU interface when in System-register mode. 

e Writing to the Software Generated Interrupt Register, 
GICD_SGIR, in the external Distributor when in memory-mapped 
mode. 


A maximum of 16 SGIs, ID0-ID15, can be generated for each 
processor interface. An SGI has edge-triggered properties. The 
software triggering of the interrupt is equivalent to the edge transition 
of the interrupt signal on a peripheral input. 


System Errors can be generated internally using the nSEI, nVSEI, or 
nREI signals. See the ARM” Generic Interrupt Controller 
Architecture Specification, GICv3 for more information. 


A virtual interrupt generated by a write to the Distributor that is 
destined for one or more processors within a specific affinity 
hierarchy. See the ARM® Generic Interrupt Controller Architecture 
Specification, GICv3 for more information. 


The processor implements a 5-bit version of the interrupt priority field, so it can support 32 interrupt 
priority levels in Secure state. 
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8.2.4 GIC bypass modes 


This section describes the two GIC bypass modes. The bypass modes are: 
e GICCDISABLE bypass mode on page 8-323. 
¢ Software bypass mode on page 8-323. 


GICCDISABLE bypass mode 


When using an external standalone interrupt controller such as the ARM GIC-400 or a proprietary 
interrupt controller, you must set the GICCDISABLE signal HIGH. This forces the GIC CPU interface 
to operate in bypass mode as described in the ARM® Generic Interrupt Controller Architecture 
Specification, GICv3. 


When the GICCDISABLE signal is tied HIGH, the PERIPHBASE[43:18] value can be read in the 
Configuration Base Address Register, to permit software to read the location of the GIC if it exists in the 
system external to the Cortex-A72 processor. 


When the GICCDISABLE signal is HIGH, you must tie these CPU interface input signals LOW: 
e ICDTVALID. 


e ICDTDATA. 
* ICDTLAST. 
* ICDTDEST. 


e ICCTREADY. 
When the GICCDISABLE signal is HIGH, you must leave these CPU interface output signals 


unconnected: 

e ICCTVALID. 
e ICCTDATA. 
¢ ICCTLAST. 
¢ ICCTID. 


e ICDTREADY. 
e nVCPUMNTIRQIN:0]. 
If GICCDISABLE is tied HIGH, the nVIRQ and nVFIQ inputs can be: 


¢ Tied off to HIGH if they are not in use. 
e Driven by an external GIC in the SoC. 


Related information 
4.5.24 Configuration Base Address Register on page 4-274. 
8.2.5 nIRQ and nVFIQ inputs on page 8-323. 


Software bypass mode 


The GIC CPU interface supports software interrupt bypass mode through interrupt disable bypass bits for 
both memory-mapped accesses and System register accesses. Unlike the GICCDISABLE bypass mode, 
the software bypass mode does not fully disable the internal GIC CPU interface. 


For more information, see the ARM® Generic Interrupt Controller Architecture Specification, GICV3. 


8.2.5 nIRQ and nVFIQ inputs 


The Cortex-A72 processor includes the virtual interrupt signals, nVIRQ and nVFIQ. There is one 
nVIRQ and one nVFIQ for each core. 


°- IfGICCDISABLE is tied HIGH, nVIRQ and nVFIQ can be: 
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— Tied off to HIGH if they are not in use. 
— Driven by an external GIC in the SoC. 

¢ If GICCDISABLE is tied LOW and the GIC virtual CPU interface is enabled and in use, ARM 
recommends to tie nVIRQ and nVFIQ off to HIGH. This is because the internal GIC CPU interface 
generates the virtual interrupt signals to the cores. 
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8.3 GIC programmers model 
Describes the GIC programmers model for the Cortex-A72 processor. 


This section contains the following subsections: 

e 8.3.1 CPU interface register summary on page 8-325. 

e 8.3.2 CPU interface memory-mapped register descriptions on page 8-328. 
e 8.3.3 CPU interface System register descriptions on page 8-330. 

¢ 8.3.4 Virtual interface control register summary on page 8-331. 

¢ 8.3.5 Virtual interface control register descriptions on page 8-333. 

¢ 8.3.6 Virtual CPU interface register summary on page 8-335. 

e 8.3.7 Virtual CPU interface register descriptions on page 8-336. 


8.3.1 CPU interface register summary 


Each GIC CPU interface block provides the interface for a Cortex-A72 processor that operates with the 
GIC. Each CPU interface provides a programming interface for: 

¢ Enabling the signaling of interrupt requests by the CPU interface. 

e Acknowledging an interrupt. 

¢ Indicating completion of the processing of an interrupt. 

e Setting an interrupt priority mask for the core. 

¢ Defining the preemption policy for the core. 

e Determining the highest priority pending interrupt for the core. 


For more information on CPU interfaces, see the ARM® Generic Interrupt Controller Architecture 
Specification, GICv3. 
AArch32 GIC CPU interface memory-mapped register summary 


The following table shows the GIC CPU interface register address offsets of the Cortex-A72 processor. 
For information about an external standalone GIC such as the ARM GIC-400 or other proprietary GIC, 
see the documentation of that product. 


The following table shows the register memory map for the CPU interface in AArch32. The offsets in 
this table are relative to the CPU interface block base address as shown in Table 8-1 Cortex-A72 
processor GIC memory map on page 8-320. 


All the registers in the following table are word-accessible. Registers not described in this table are 








Reserved. 
Table 8-2 GIC CPU interface memory-mapped register summary 
Offset Name Type Reset Description 
@x@008 GICC_CTLR RW @0x00000000 CPU Interface Control Register 44 
@x0@004 GICC_PMR RW 0x00000000 Interrupt Priority Mask Register 





@xe008 GICC BPR RW @0x00000002 (S)! Binary Point Register 











0x00000003 (NS)! 
@x@8EC GICC_IAR RO 0x@00003FF Interrupt Acknowledge Register 
0x0010 GICC EOIR WO - End Of Interrupt Register 
0x0014 GICC_RPR RO 0Xx0000OOFF Running Priority Register 








dq See the ARM” Generic Interrupt Controller Architecture Specification, GICv3 for more information. 
dr § = Secure. 
ds NS = Non-secure. 
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Table 8-2 GIC CPU interface memory-mapped register summary (continued) 
































Offset Name Type Reset Description 

0x0018 GICC_HPPIR RO 0x@@0003FF Highest Priority Pending Interrupt Register 

@x@@1C GICC_ABPR RW 0x00000003 Aliased Binary Point Register 

0x0020 GICC AIAR RO 0x000003FF Aliased Interrupt Acknowledge Register 

0x0024 GICC_AEOIR WO - Aliased End of Interrupt Register 

0x0028 GICC_AHPPIR RO 0x@@0003FF Aliased Highest Priority Pending Interrupt Register 
@x@@D@ GICC_APRO RW 0x00000000 Active Priority Register on page 8-328 

@x@@E@ GICC_NSAPRO RW 0x00000000 Non-secure Active Priority Register on page 8-329 
@x8@FC GICC IDR RO 0x0084043B CPU Interface Identification Register on page 8-329 
0x1000 GICC DIR WO - Deactivate Interrupt Register 





AArch32 GIC CPU interface System register summary 


The following table shows the System register map for the CPU interface in AArch32. See the ARM® 
Generic Interrupt Controller Architecture Specification, GICv3 for more information about the registers. 


Table 8-3 AArch32 GIC CPU interface System register summary 















































Name CRn op1 CRm op2 Type Description 

ICC_PMR c4 0 c6 0 RW Priority Mask Register 

ICC_IARO cl2 0 c8 0 RO Group0 Interrupt Acknowledge Register 
ICC_EOIRO 1 WO Group0 End of Interrupt Register 

ICC_HPPIRO 2 RO Group0 Highest Priority Pending Interrupt Register 
ICC_BPRO 3 RW Group0 Binary Pointer Register 

ICC_APORO 4 RW Active Priority Group0 Register on page 8-330 
ICC_AP1RO c9 0 RW Active Priority Group! Register on page 8-331 
ICC_DIR cll 1 WO Deactivate Register 

ICC_RPR 3 RO Running Priority Register 
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Table 8-3 AArch32 GIC CPU interface System register summary (continued) 













































































Name CRn op1 CRm op2 Type Description 

ICC_IARI cl2 0 RO Group! Interrupt Acknowledge Register 
ICC_EOIR1 1 WO Group! End of Interrupt Register 

ICC_HPPIR1 2 RO Group! Highest Priority Pending Interrupt Register 
ICC_BPR1 3 RW B* Group! Binary Pointer Register 

ICC_CTLR 4 RWB Control Register 

ICC_SRE 5 RWB System Register Enable 

ICC_IGRPENO 6 RW Group0 Interrupt Group Enable 

ICC_IGRPEN1 T RWB Group! Interrupt Group Enable 

ICC_SGHUR - WO Group! Software Generated Interrupt Register 
ICC_ASGIIR 0 cl2 - WO Aliased Group! Software Generated Interrupt Register 
ICC_SGIOR 2 cl2 - WO Group0 Software Generated Interrupt Register 
ICC_MCTLR 6 cl2 4 RW Monitor Control Register 

ICC_MSRE 5 RW Monitor System Register Enable 

ICC_MGRPEN1 7 RW Monitor Group! Interrupt Group Enable 





AArch64 GIC CPU interface System register summary 


The following table shows the System register map for the GIC CPU interface in AArch64. See the 
ARM® Generic Interrupt Controller Architecture Specification, GICv3 for more information about the 
registers. 


Table 8-4 AArch64 GIC CPU interface System register summary 











Name Type Description 
ICC_PMR_EL1 RW Priority Mask Register 
ICC_IARO_ ELI] RO Group0 Interrupt Acknowledge Register 





ICC_EOIRO_EL1 WO Group0 End of Interrupt Register 





ICC_HPPIRO ELI RO Group0 Highest Priority Pending Interrupt Register 





ICC_BPRO EL1 RW Group0 Binary Pointer Register 





ICC_APORO EL1 RW Active Priority Group0 Register on page 8-330 





ICC_AP1RO_ EL1 RW Active Priority Group! Register on page 8-331 








ICC_DIR_EL1 WO Deactivate Register 





ICC_RPR_EL1 RO Running Priority Register 





ICC_SGIHR_EL1 WO Group! Software Generated Interrupt Register 





ICC_ASGIIR_ ELI WO Aliased Group! Software Generated Interrupt Register 








dt When operating in EL3, accesses to Banked EL1 registers access the copy designated by the current value of the SCR_EL3.NS. When EL3 is using AArch32, there 
is no Secure EL] interrupt regime and accesses in any Secure EL3 mode, except Monitor mode, access the Secure copy. 


du Use MCRR instructions to access this register in AArch32 state. 
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Table 8-4 AArch64 GIC CPU interface System register summary (continued) 





Name Type Description 





ICC_SGIOR_EL1 WO Group0 Software Generated Interrupt Register 





ICC_IAR1 ELI RO Group! Interrupt Acknowledge Register 





ICC_EOIR1 EL1 WO Group! End of Interrupt Register 





ICC_HPPIR1 ELI RO Group! Highest Priority Pending Interrupt Register 





ICC_BPR1 EL1 RW B% Group] Binary Pointer Register 





ICC_CTLR ELI RWB Control Register 





ICC_SRE_EL1 RWB System Register Enable 





ICC_IGRPEN0_EL1I RW Group0 Interrupt Group Enable Register 





ICC_IGRPEN1_ EL! RWB — Group! Interrupt Group Enable 





ICC_CTLR_EL3 RW EL3 Control Register 





ICC_SRE_ EL3 RW EL3 System Register Enable 





ICC_GRPEN1 EL3 RW EL3 Group! Interrupt Group Enable 





8.3.2 CPU interface memory-mapped register descriptions 


This section only describes registers whose implementation is specific to the Cortex-A72 processor. All 
other registers are described in the ARM® Generic Interrupt Controller Architecture Specification, 
GICv3. Table 8-2 GIC CPU interface memory-mapped register summary on page 8-325 provides cross- 
references to individual registers. 


Active Priority Register 


The GICC_APRO characteristics are: 


Purpose 
Provides support for preserving and restoring state in power-management applications. 

Usage constraints 
This register is Banked to provide Secure and Non-secure copies. This ensures that Non-secure 
accesses do not interfere with Secure operation. 

Configurations 
Available if the GIC is implemented and setup for memory-mapped accesses. 

Attributes 
See the register summary in Table 8-2 GIC CPU interface memory-mapped register summary 
on page 8-325. 


The processor implements the GICC_APRO according to the recommendations described in the ARM® 
Generic Interrupt Controller Architecture Specification, GICv3. 


The following table shows the Cortex-A72 processor GICC_APRO implementation. 





dv When operating in EL3, accesses to Banked ELI registers access the copy designated by the current value of the SCR_EL3.NS. When EL3 is using AArch32, there 
is no Secure EL] interrupt regime and accesses in any Secure EL3 mode, except Monitor mode, access the Secure copy. 
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Table 8-5 Active Priority Register implementation 








Number of Preemption Minimum legal Minimum legal Active Priority View of Active Priority 
group levels value of Secure value of Non- Registers Registers for Non-secure 
priority bits GICC_BPR secure implemented accesses 

GICC_BPR 
5 32 2 3 GICC_APRO[31:0] GICC_NSAPRO[31:16] appears 


as GICC_APRO[15:0] 





Non-secure Active Priority Register 


The GICC_NSAPRO characteristics are: 


Purpose 
Provides support for preserving and restoring state in power-management applications. 
Usage constraints 
This register is only accessible from a Secure access. 
Configurations 
Available if the GIC is implemented. 
Attributes 
See the register summary in Table 8-2 GIC CPU interface memory-mapped register summary 
on page 8-325. 


The processor implements the GICC_NSAPRO according to the recommendations described in the ARM® 
Generic Interrupt Controller Architecture Specification, GICv3. It is consistent with the GICC_APRO 
Register. 


CPU Interface Identification Register 


The GICC_IIDR characteristics are: 


Purpose 
Provides information about the implementer and revision of the CPU interface. 
Usage constraints. 
There are no usage constraints. 
Configurations 
Available if the GIC is implemented. 
Attributes 
See the register summary in Table 8-2 GIC CPU interface memory-mapped register summary 
on page 8-325. 


The following figure shows the GICC_IIDR bit assignments. 


31 20 19 16 15 12 11 0 


ProductID Architecture Implementer 
version 


Figure 8-1 GICC_IIDR bit assignments 
The following table shows the GICC_IIDR bit assignments. 
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Table 8-6 GICC_IIDR bit assignments 





Bit 


Name 


Function 





[31:20] 


ProductID Identifies the product: 


0x008 Product ID. 





[19:16] 


Architecture version Identifies the architecture version of the GIC: 


0x4 Version 4. 





[15:12] 





Revision 


Identifies the revision number for the CPU interface: 


0x0 Revision 0. 





[11:0] 


Implementer Contains the JEP106 code of the company that implemented the CPU interface. For an ARM 


implementation, these values are: 

Bits[11:8] = 0x4 The JEP106 continuation code of the implementer. 
Bit[7] Always 0. 

Bits[6:0] = @x3B The JEP106 identity code of the implementer. 





8.3.3 


CPU interface System register descriptions 


This section only describes registers whose implementation is specific to the Cortex-A72 processor. All 
other registers are described in the ARM" Generic Interrupt Controller Architecture Specification, 
GICv3. Table 8-4 AArch64 GIC CPU interface System register summary on page 8-327 provides cross- 
references to individual registers. 


Active Priority Group0 Register 


The ICC_APORO_ ELI characteristics are: 


Purpose 
Provides support for preserving and restoring state in power-management applications. 
Usage constraints 
Accessibility and constraints on this register are described in the ARM® Generic Interrupt 
Controller Architecture Specification, GICv3. 
Configurations 
Available if the GIC is implemented for System register mode. 
Attributes 
See the register summary in Table 8-4 AArch64 GIC CPU interface System register summary 
on page 8-327. 


The multiprocessor implements the ICC_APORO_ ELI according to the recommendations described in 
the ARM® Generic Interrupt Controller Architecture Specification, GICv3. 


The following table shows the Cortex-A72 MPCore processor ICC_APORO_EL1 implementation. 


Table 8-7 Active Priority Group0 Register implementation 





Number of group priority Preemption levels Minimum legal value of Active Priority Group0 Registers 


bits 


BPR implemented 





5 


32 2 ICC_APORO_EL1[31:0] 
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Active Priority Group1 Register 


The ICC_AP1RO_ ELI characteristics are: 


Purpose 
Provides support for preserving and restoring state in power-management applications. 
Usage constraints 
This register is Banked to provide Secure and Non-secure copies. This ensures that Non-secure 
accesses do not interfere with Secure operation. Accessibility and constraints on this register are 
described in the ARM” Generic Interrupt Controller Architecture Specification, GICv3. 
Configurations 
Available if the GIC is implemented for System register mode. 
Attributes 
See the register summary in Table 8-4 AArch64 GIC CPU interface System register summary 
on page 8-327. 


The multiprocessor implements the ICC_AP1RO_EL1 according to the recommendations described in 
the ARM® Generic Interrupt Controller Architecture Specification, GICv3. 


The following table shows the Cortex-A72 processor ICC_AP1RO_EL1 implementation. 


Table 8-8 Active Priority Group1 Register implementation 











Number of group Preemption Minimum legal value Minimum legal value Active Priority Group1 
priority bits levels of Secure BPR of Non-secure BPR Registers implemented 
5 32 2 3 ICC_AP1RO_EL1[31:0] 
8.3.4 Virtual interface control register summary 


The virtual interface control registers are management registers. The processor configuration software 
must ensure that these registers are accessible only by a hypervisor, or similar software. 


Virtual interface control register summary 


The following table shows the register map for the virtual interface control registers. The offsets in this 
table are relative to the virtual interface control registers block base address as shown in Table 8-1 
Cortex-A72 processor GIC memory map on page 8-320. 


All the registers in the following table are word-accessible. Registers not described in this table are 
Reserved. 


Table 8-9 Virtual interface control register summary 





Offset Name Type Reset Description 





0x000 GICH HCR RW @x00000000 Hypervisor Control Register 9Y 





0x004 GICH _ VTR RO 0x90000003 VGIC Type Memory-Mapped Register on page 8-333 





0x008 GICH_VMCR RW _  0x@04C@@@@ Virtual Machine Control Register 4” 





0x010 GICH MISR RO @0x0000000O Maintenance Interrupt Status Register “” 





0x020 GICH EISRO RO @0x00000000 End of Interrupt Status Register 9Y 





0x030 GICH ELRSRO RO @x@@Q@@@@@F Empty List Register Status Register“ 








dw See the ARM” Generic Interrupt Controller Architecture Specification GICv3 for more information. 
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Table 8-9 Virtual interface control register summary (continued) 




















Offset Name Type Reset Description 

@x@F@ GICH APR RW @x00000000 Active Priorities Register 9Y 
0x100 GICH_LRO RW @0Xx0000000O List Register 0 “v 

0x104 GICH LRI RW 0x00000000 List Register 1 4 

0x108 GICH LR2 RW @0Xx0000OOOO List Register 2 W 

0x10C GICH_LR3 RW @x000OOOOOO List Register 3” 





AArch32 virtual interface System register summary 


The following table shows the register map for the AArch32 virtual interface System registers. The 
offsets in this table are relative to the virtual interface control registers block base address as shown in 
Table 8-1 Cortex-A72 processor GIC memory map on page 8-320. 


All the registers in the following table are word-accessible. Registers not described in this table are 


Reserved. 


Table 8-10 AArch32 virtual interface System register summary 
















































































Name CRn op1 CRm op2 Type Description 

ICH_APRO cl2 4 c8 0 RW _ Hypervisor Active Priority Register 0 
ICH_APR1 c9 0 RW _ Hypervisor Active Priority Register 1 
ICH_VSEIR 4 RW Virtual System Error Interrupt Register 
ICH_SRE 5 RW Hypervisor System Register 
ICH_HCR 4 cll 0 RW _ Hypervisor Control Register 
ICH_VTR 1 RO  VGIC Type Register 

ICH_MISR 2 RO Maintenance Interrupt Status Register 
ICH_EISR 3 RO End of Interrupt Status Register 
ICH_ELRSR 5 RO Empty List Register Status Register 
ICH_VMCR 7 RW Virtual Machine Control Register 
ICH_LRO cl2 0 RW List Register 0 to 3 

ICH_LRI1 1 RW 

ICH_LR2 2 RW 

ICH_LR3 3 RW 

ICH_LRCO cl4 0 RW List Register Extension 0 to 3 
ICH_LRC1 1 RW 

ICH_LRC2 2 RW 

ICH_LRC3 3 RW 
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AArché64 virtual interface System register summary 


The following table shows the register map for the AArch64 virtual interface System registers. The 
offsets in this table are relative to the virtual interface control registers block base address as shown in 
Table 8-1 Cortex-A72 processor GIC memory map on page 8-320. 


All the registers in the following table are word-accessible. Registers not described in this table are 















































Reserved. 

Table 8-11 AArch64 virtual interface System register summary 
Name Type Description 
ICH_APRO EL2 RW Hypervisor Active Priority Register 
ICH_VSEIR_EL2 RW Virtual System Error Interrupt Register 
ICH_HCR_EL2 RW Hypervisor Control Register 
ICH_VTR_EL2 RO _ VGIC Type Register 
ICC_SRE EL2 RW _ Hypervisor System Register Enable 
ICH_MISR_EL2 RO Maintenance Interrupt Status Register 
ICH_EISR_EL2 RO End of Interrupt Status Register 
ICH_ELRSR_EL2 RO Empty List Register Status Register 
ICH_VMCR_EL2 RW Virtual Machine Control Register 
ICH_LRO_EL2 RW List Register 0 
ICH_LR1_ EL2 RW List Register 1 
ICH_LR2 EL2 RW List Register 2 
ICH_LR3_EL2 RW List Register 3 

8.3.5 Virtual interface control register descriptions 


This section only describes registers whose implementation is specific to the Cortex-A72 processor. All 
other registers are described in the ARM” Generic Interrupt Controller Architecture Specification, 
GICv3. 


VGIC Type Memory-Mapped Register 


The GICH_VTR characteristics are: 


Purpose 
Holds information on number of priority bits, number of preemption bits, and number of List 
Registers implemented. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available if the GIC is implemented and setup for memory-mapped accesses. 
Attributes 
See the register summary in Table 8-9 Virtual interface control register summary 
on page 8-331. 


The following figure shows the GICH_VTR bit assignments. 
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31 2928 2625 


6 


5 


0 


Figure 8-2 GICH_VTR bit assignments 


wing table shows the GICH_VTR bit assignments. 


Table 8-12 GICH_VTR bit assignments 


Bit Name Description 





[31:29] PRIbits Indicates 
0b100 


the number of priority bits implemented, minus one: 


Five bits of priority and 32 priority levels. 





[28:26] PREbits Indicates 
0b100 


the number of preemption bits implemented, minus one: 


Five bits of preemption and 32 preemption levels. 





[25:6] - Reserved, RAZ. 





[5:0]  ListRegs Indicates 


the number of implemented List Registers, minus one: 


@bee 0011 Four List Registers. 





VGIC Type System Register 


The ICH 


Purpose 


_VTR_EL2 characteristics are: 


Holds information on number of priority bits, number of preemption bits, and number of List 


Registers implemented. 


Usage constraints 


Configu 


There are no usage constraints. 
rations 
Available if the GIC is implemented and setup for System register accesses. 


Attributes 
See the register summary in Table 8-9 Virtual interface control register summary 


on page 8-331.. 


The following figure shows the ICH_VTR_EL2 bit assignments. 


3 2928 2625 23222120 


SEIS- La3v 


5 


4 


1 


0 


Figure 8-3 ICH_VTR_EL2 bit assignments 


The following table shows the ICH_VTR_EL2 bit assignments. 
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Table 8-13 ICH_VTR_EL2 bit assignments 





Bit 


Name 


Description 





[31:29] 


PRIbits 


Indicates the number of priority bits implemented, minus one: 


0b100 Five bits of priority and 32 priority levels. 





[28:26] 


PREbits 


Indicates the number of preemption bits implemented, minus one: 


@b100 Five bits of preemption and 32 preemption levels. 





IDbits 





[25:23] 


Indicates the number of virtual interrupt identifier bits supported: 


e@beee 16 bits of virtual interrupt identifier. 





[22] 


SEIS 


Indicates if locally generated virtual System Errors are supported: 


@be Locally generated virtual System Errors are not supported. 





[21] 


A3V 


Indicates if affinity level 3 is supported in SGI generation from System registers: 


Qbe SGI generation from System registers does not support affinity level 3. 





[20:5] 


Reserved, RAZ. 





[4:0] 


ListRegs 


Indicates the number of implemented List Registers, minus one: 


0b000011 Four List Registers. 





8.3.6 


Virtual CPU interface register summary 


The virtual CPU interface forwards virtual interrupts to a connected Cortex-A72 processor, subject to the 
normal GIC handling and prioritization rules. The virtual interface control registers control virtual CPU 
interface operation, and in particular, the virtual CPU interface uses the contents of the List registers to 
determine when to signal virtual interrupts. When a core accesses the virtual CPU interface, the List 
registers are updated. 


For more information on virtual CPU interface, see the ARM® Generic Interrupt Controller Architecture 
Specification, GICv3. 


The following table shows the register map for the virtual CPU interface. The offsets in this table are 
relative to the virtual CPU interface block base address as shown in Table 8-1 Cortex-A72 processor 
GIC memory map on page 8-320. 


All the registers in the following table are word-accessible. Registers not described in this table are 
Reserved. 


Table 8-14 Virtual CPU interface register summary 





Offset Name Type Reset Description 





0x000 GICV_CTLR RW @0x0000000O VM Control Register 





@x0004 GICV_PMR RW @x0000000O VM Priority Mask Register “ 





0x0008 GICV BPR RW @0x00000002 VM Binary Point Register 9 





@x8@8EC GICV_IAR RO @x000003FF VM Interrupt Acknowledge Register 








<i/si<i< 


0x0010 GICV_EOIR WO - M End Of Interrupt Register “* 








dx 


See the ARM” Generic Interrupt Controller Architecture Specification GICv3 for more information. The System register counterparts of these registers are described 
in the ARM® Generic Interrupt Controller Architecture Specification GICv3. The virtual CPU interface System registers do not have a separate encoding from the 
physical CPU interface System registers but access is controlled from the appropriate system controls that the ARM” Generic Interrupt Controller Architecture 
Specification GICv3 describes. 
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Table 8-14 Virtual CPU interface register summary (continued) 






































Offset Name Type Reset Description 

0x0014 GICV_RPR RO @x@@@@@@FF VM Running Priority Register “ 

@x@018 GICV_HPPIR RO 0x@0@00@3FF VM Highest Priority Pending Interrupt Register “ 
@x@01C GICV_ABPR RW @0x00000003 VM Aliased Binary Point Register “* 

0x0020 GICV_AIAR RO @x@@@@@3FF VM Aliased Interrupt Acknowledge Register “* 

@x@024 GICV_AEOIR WO - VM Aliased End of Interrupt Register “ 

@x@@28 GICV_AHPPIR RO @x@Q00@3FF VM Aliased Highest Priority Pending Interrupt Register 9 
@x@02C GICV_STATUSR RW - VM Error Reporting Status Register 1% 

@x@e@D@ GICV_APRO RW 0x@0000008 VM Active Priority Register on page 8-336 

@x@@FC GICV_IIDR RO @x0@@84043B VM CPU Interface Identification Register on page 8-336 
0x1000 GICV_DIR WO - VM Deactivate Interrupt Register 





8.3.7 Virtual CPU interface register descriptions 


This section only describes registers whose implementation is specific to the Cortex-A72 processor. 


All other registers are described in the ARM® Generic Interrupt Controller Architecture Specification, 
GICv3. Table 8-14 Virtual CPU interface register summary on page 8-335 provides cross-references to 
individual registers. 


VM Active Priority Register 


The GICV_APRO characteristics are: 


Purpose 
For software compatibility, this register is present in the virtual CPU interface. However, in 
virtualized system, it is not used in the preserving and restoring state. 
Usage constraints 
Reading the content of this register and then writing the same values must not change any state 
because there is no requirement to preserve and restore state during a power down. 
Configurations 
Available if the GIC is implemented. 
Attributes 
See the register summary in Table 8-14 Virtual CPU interface register summary on page 8-335. 


The multiprocessor implements the GICV_APRO as an alias of GICH_APR. 


VM CPU Interface Identification Register 


The GICV_IIDR characteristics are: 


Purpose 
Provides information about the implementer and revision of the virtual CPU interface. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available if the GIC is implemented. 
Attributes 
See the register summary in Table 8-14 Virtual CPU interface register summary on page 8-335. 
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The bit assignments for the VM CPU Interface Identification Register are identical to the corresponding 
register in the CPU interface. 


Related information 
CPU Interface Identification Register on page 8-329. 
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Generic Timer 


This chapter describes the Cortex-A72 processor implementation of the ARM Generic Timer. 


It contains the following sections: 

e 9.1 About the Generic Timer on page 9-339. 

e 9.2 Generic Timer functional description on page 9-340. 
e 9.3 Generic Timer register summary on page 9-341. 
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9.1 About the Generic Timer 


The Generic Timer in the Cortex-A72 processor can schedule events and trigger interrupts based on an 
incrementing counter value. 


It provides: 
e Generation of timer events as interrupt outputs. 
e Generation of event streams. 


The Generic Timer is compliant with the ARM” Architecture Reference Manual ARMVv8, for ARMv8s-A 
architecture profile. 


This chapter only describes features that are specific to the Cortex-A72 processor implementation. 
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9.2 Generic Timer functional description 
The Cortex-A72 processor provides a set of timers for each core in the processor. 


The timers are: 

e A Non-secure EL! physical timer. 
e A Secure EL1 physical timer. 

e A Non-secure EL2 physical timer. 
e A virtual timer. 


The processor does not include the system counter that resides in the SoC. The system counter value is 
distributed to the Cortex-A72 processor with a synchronous binary encoded 64-bit bus, 
CNTVALUEB[63:0]. 


Because CNT VALUEB is generated from a system counter that typically operates at a slower frequency 
than the main processor CLK, the CNTCLKEN input is provided as a clock enable for the 
CNTVALUEB bus. 


Each timer provides an active-LOW interrupt output that is an external pin to the SoC. 


The following table shows the signals that are the external interrupt output pins. 


Table 9-1 Generic Timer signals 





Signal? Description 





nCNTPNSIRQ[n:0] Non-secure EL1 physical timer interrupt 





nCNTPSIRQJ[n:0] Secure EL1 physical timer interrupt 





nCNTHPIRQJn:0] Non-secure EL2 physical timer interrupt 





nCNTVIRQJ[n:0] Virtual timer interrupt 





Related information 
2.3.1 Clocks on page 2-32. 
2.3.1 Clocks on page 2-32. 





dy nis the number of processors present in the MPCore device, minus one. 
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9.3 Generic Timer register summary 
Within each core, a set of Generic Timer registers are allocated to the CP15 coprocessor space. 
The Generic Timer registers are either 32-bit or 64-bit wide and accessible in the AArch32 and AArch64 
states. 
This section contains the following subsections: 
e 9.3.1 AArch64 Generic Timer register summary on page 9-341. 
e 9.3.2 AArch32 Generic Timer register summary on page 9-341. 
9.3.1 AArch64 Generic Timer register summary 
The following table shows the AArch64 Generic Timer registers. See the ARM® Architecture Reference 
Manual ARMv8 for information about these registers. 
Table 9-2 AArch64 Generic Timer registers 
Name Type Reset Width Description 
CNTKCTL ELI RW -£ 32-bit Timer Control register (EL1) 
CNTFRQ ELO RW“ UNK 32-bit Timer Counter Frequency register 
CNTPCT_ELO RO UNK 64-bit Physical Timer Count register 
CNTVCT_ELO RO UNK 64-bit Virtual Timer Count register 
CNTP_TVAL ELO RW UNK 32-bit Physical Timer TimerValue (ELO) 
CNTP_CTL_ELO RW -è 32-bit Physical Timer Control register (EL0) 
CNTP_CVAL ELO RW UNK 64-bit Physical Timer CompareValue register (ELO) 
CNTV_TVAL_ELO RW UNK 32-bit Virtual Timer TimerValue register 
CNTV_CTL_ELO RW -è 32-bit Virtual Timer Control register 
CNTV_CVAL ELO RW UNK 64-bit Virtual Timer CompareValue register 
CNTVOFF_EL2 RW UNK 64-bit Virtual Timer Offset register 
CNTHCTL_EL2 RW -° 32-bit Timer Control register (EL2) 
CNTHP_TVAL EL2 RW UNK 32-bit Physical Timer TimerValue register (EL2) 
CNTHP CTL EL2 RW -è 32-bit Physical Timer Control register (EL2) 
CNTHP_CVAL_EL2 RW UNK 64-bit Physical Timer CompareValue register (EL2) 
CNTPS_TVAL_ELI RW UNK 32-bit Physical Timer TimerValue register (EL2) 
CNTPS CTL ELI RW -°% 32-bit Physical Secure Timer Control register (EL1) 
CNTPS CVAL ELI RW UNK 64-bit Physical Secure Timer CompareValue register (EL1) 
9.3.2 AArch32 Generic Timer register summary 
The following table shows the AArch32 Generic Timer registers. 
See the ARM” Architecture Reference Manual ARMV8 for information about these registers. 
dz 


ea 
eb 
ec 


The reset value for bits[9:8, 2:0] is 2600000. 

Only at EL3, otherwise this register is RO. 

The reset value for bit[0] is 0. 

The reset value for bit[2] is 0 and for bits[1:0] is @b11. 
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Table 9-3 AArch32 Generic Timer registers 













































































Name CRn op1 CRm op2 Type Reset Width Description 
CNTFRQ c14 0 c0 0 RW! UNK 32-bit Timer Counter Frequency register 
CNTPCT - 0 cl4 - RO UNK 64-bit Physical Timer Count register 
CNTKCTL c14 0 cl 0 RW ae 32-bit EL1 Timer Control register 
CNTP_TVAL c2 0 RW UNK 32-bit EL1 Physical Timer TimerValue register 
CNTP_CTL 1 RW -ef 32-bit EL1 Physical Timer Control register 
CNTV_TVAL c3 0 RW UNK 32-bit Virtual Timer TimerValue register 
CNTV_CTL 1 RW ef 32-bit Virtual Timer Control register 
CNTVCT - 1 cl4 - RO UNK 64-bit Virtual Timer Count register 
CNTP_CVAL 2 RW UNK 64-bit EL1 Physical Timer CompareValue 
register 
CNTV_CVAL 3 RW UNK 64-bit Virtual Timer CompareValue register 
CNTVOFF 4 RW UNK 64-bit Virtual Timer Offset register 
CNTHCTL c14 4 cl 0 RW 88 32-bit EL2 Timer Control register 
CNTHP_TVAL c2 0 RW UNK 32-bit EL2 Physical Timer TimerValue register 
CNTHP_CTL 1 RW ef 32-bit EL2 Physical Timer Control register 
CNTHP_CVAL - 6 cl4 - RW UNK 64-bit EL2 Physical Timer CompareValue 
register 

ed Only at EL3, otherwise this register is RO. 

Ce The reset value for bits[9:8, 2:0] is @b00000. 

ef The reset value for bit[0] is 0. 

eg The reset value for bit[2] is 0 and for bits[1:0] is @b11. 
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Chapter 10 
Debug 


This section describes the Cortex-A72 processor debug registers and shows examples of how to use 
them. 


It contains the following sections: 

¢ 10.1 About debug on page 10-344. 

¢ 10.2 Debug register interfaces on page 10-346. 

e 10.3 AArch64 debug register summary on page 10-348. 

¢ 10.4 AArch64 debug register descriptions on page 10-350. 
e 10.5 AArch32 debug register summary on page 10-356. 

e 10.6 AArch32 debug register descriptions on page 10-358. 
e 10.7 Memory-mapped register summary on page 10-362. 

e 10.8 Memory-mapped register descriptions on page 10-366. 
e 10.9 Debug events on page 10-380. 

e 10.10 External debug interface on page 10-381. 

¢ 10.11 ROM table on page 10-384. 
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10.1 About debug 


Provides an overview of debug and describes the debug components. 


The processor forms one component of a debug system. You can use the following invasive debug 
methods: 


Conventional JTAG debug (external debug) 
The processor halts execution when breakpoints and watchpoints are triggered. A debug 
connection enables you to examine and modify registers and memory, and provide single-step 
execution. 

Conventional monitor debug (self-hosted debug) 
The processor runs a debug monitor that resides in memory. 


The following figure shows a typical JTAG debug system. 


Debug 


host Debug host computer running suitable debugger tool 


Protocol 
converter 


for example, DSTREAM or RealView ICE 


=, 








Debug 


target Development system containing ARM processor 











Figure 10-1 Typical debug system 


This section contains the following subsections: 
e 10.1.1 Debug host on page 10-344. 

e 10.1.2 Protocol converter on page 10-344. 

e 10.1.3 Debug target on page 10-345. 

¢ 10.1.4 The debug unit on page 10-345. 

e 10.1.5 Self-hosted debug on page 10-345. 


10.1.1 Debug host 


The debug host is a computer, for example a personal computer, running a software debugger such as the 
DS-5 Debugger. The debug host enables you to issue high-level commands such as setting breakpoint at 
a certain location, or examining the contents of a memory address. 


10.1.2 Protocol converter 


The debug host sends messages to the debug target using an interface such as Ethernet. However, the 
debug target typically implements a different interface protocol. A device such as DSTREAM is required 
to convert between the two protocols. 
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10.1.3 Debug target 


The debug target is the lowest level of the system. An example of a debug target is a development system 
with a test chip or a silicon part with a processor. 


The debug target implements system support for the protocol converter to access the debug unit using the 
AMBA Advanced Peripheral Bus (APB) slave interface. 


10.1.4 The debug unit 


The processor debug unit assists in debugging software running on the processor. You can use the 
processor debug unit, in combination with a software debugger program, to debug: 


e Application software. 
e Operating systems. 
e Hardware systems based on an ARM processor. 


The debug unit enables you to: 

e Stop program execution. 

e Examine and alter process and coprocessor state. 

e Examine and alter memory and input/output peripheral state. 
e Restart the processor. 


10.1.5 Self-hosted debug 


For self-hosted debug, the debug target runs additional debug monitor software, and uses the on-chip bus 
fabric to send messages to the APB slave interface on the debug unit. 
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10.2 Debug register interfaces 
This section describes the debug architecture and debug events of the processor. 


The processor implements the ARMv8 Debug architecture and debug events as described in the ARM* 
Architecture Reference Manual ARMV8. 


The Debug architecture defines a set of debug registers. The debug register interfaces provide access to 
these registers from: 

¢ Software running on the processor. 

e An external debugger. 


This section contains the following subsections: 

¢ 10.2.1 Processor interfaces on page 10-346. 

e 10.2.2 Breakpoints and watchpoints on page 10-346. 

¢ 10.2.3 Effects of resets on debug registers on page 10-346. 
e 10.2.4 External access permissions on page 10-347. 


10.2.1 Processor interfaces 


System register access allows the processor to directly access certain debug registers. The external debug 
interface allows both external and self-hosted debug agents to access debug registers. 


Access to the debug registers is partitioned as follows: 


Debug registers 
This interface is System register based and memory-mapped. You can access the debug register 
map using the APB slave port. 

Performance monitor 
This interface is System register based and memory-mapped. You can access the performance 
monitor registers using the APB slave port. 

Trace registers 
This interface is memory-mapped. 


Related information 
10.10 External debug interface on page 10-381. 


10.2.2 Breakpoints and watchpoints 


The processor supports six hardware breakpoints, four watchpoints, and a standard Debug 
Communications Channel (DCC). Four of the breakpoints match only to Virtual Address and the other 
two match against either Virtual Address or context ID, or Virtual Machine Identifier (VMID). All the 
watchpoints can be linked to two breakpoints to enable a memory request to be trapped in a given 
process context. 


10.2.3 Effects of resets on debug registers 


The processor has the following reset signals that affect the debug registers: 


nCPUPORESET 
This signal initializes the processor logic, including the debug, Embedded Trace Macrocell 
(ETM), breakpoint, watchpoint logic, and performance monitors logic. This maps to a Cold 
reset that covers reset of the processor logic and the integrated debug functionality. 
nCORERESET 
This signal resets some of the debug and performance monitor logic. This maps to a Warm reset 
that covers reset of the processor logic. 
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This signal initializes the shared debug APB, Cross Trigger Interface (CTI), and Cross Trigger 
Matrix (CTM) logic. This maps to an external debug reset that covers the resetting of the 
external debug interface and has no impact on the processor functionality. 


10.2.4 External access permissions 


External access permission to the debug registers is subject to the conditions at the time of the access. 
The following table describe the processor response to accesses through the external debug interface. 


Table 10-1 External register access conditions 





Condition Condition trigger 


Description 





Off EDPRSR.PU is 0 


Core power domain is completely off, or in a low-power state where the 
Core power domain registers cannot be accessed. 
Note 


If debug power is off then all external debug and memory-mapped register 
accesses return an error. 








DLK EDPRSR.DLK is 1 


OS Double Lock is locked. 





OSLK OSLSR_EL1.OSLK is 1 


OS Lock is locked. 





EDAD AllowExternalDebugAccess() 


External debug access disabled. When an error is returned because of the 























==FALSE EDAD condition, and this is the highest priority error condition, 
EDPRSR.SDAD is set to 1. Otherwise SDAD is unchanged. 
SLK Memory-mapped interface only Software Lock is locked. For the external debug interface, ignore this 
condition. 
Default - None of the conditions apply, normal access. 
The following table shows an example of external register access conditions for access to a Performance 
Monitors register. To determine the access permission for the register, scan the columns from left to 
right. Stop at the first column whose condition is true, the entry gives the access permission of the 
register and scanning stops. 
Table 10-2 External register access conditions example 
Off DLK OSLK EDAD SLK Default 
- - - - RO/WI RO 
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Provides a summary of the debug control registers in the AArch64 state. 


The following table shows the debug control registers that are accessible in AArch64 state. These 
registers are accessed by the MRS and MSR instructions. 


The table also shows the offset address for the AArch64 registers that are accessible from the internal 
memory-mapped interface or the external debug interface. See /0.7 Memory-mapped register summary 
on page 10-362 for a complete list of registers accessible from the internal memory-mapped or the 


external debug interface. 


Table 10-3 AArch64 debug register summary 



















































































Offset Name Type Width Description 

- DBGDTR_ELO RW 64-bit Debug Data Transfer Register, half-duplex °" 

- DBGVCR32_EL2 RW 32-bit Debug Vector Catch Register °” 

- MDCCINT_EL1 RW 32-bit Monitor Debug Comms Channel Interrupt Enable Register ° 

- MDCCSR_ELO RO 32-bit Monitor Debug Comms Channel Status Register ° 

- MDRAR EL1 RO 64-bit Monitor Debug ROM Address Register °” 

- MDSCR_EL1 RW 32-bit Monitor Debug System Control Register © 

- OSDTRRX_EL1 RW 32-bit OS Lock Data Transfer Register, Receive, External View 

- OSDTRTX_EL1 RW 32-bit OS Lock Data Transfer Register, Transmit, External View ch 

- OSDLR_EL1 RW 32-bit OS Double Lock Register ° 

- OSLSR_ELI1 RO 32-bit OS Lock Status Register 

@x@88@ DBGDTRRX_ELO RO 32-bit Debug Data Transfer Register, Receive, Internal View ° 

@x@8C DBGDTRTX_ELO WO 32-bit Debug Data Transfer Register, Transmit, Internal View °” 

0x098 OSECCR ELI RW 32-bit OS Lock Exception Catch Control Register ° 

0x300 OSLAR_EL1 WO 32-bit Debug OS Lock Access Register ° 

@x31@ DBGPRCR_EL1 RW 32-bit Debug Power/Reset Control Register ° 

0x400 DBGBVRO EL1 RW 64-bit Debug Breakpoint Value Register 0 ° 

0x408 DBGBCRO EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL] on page 10-350 
0x410 DBGBVRI1 EL1 RW 64-bit Debug Breakpoint Value Register 1 ° 

@x418 DBGBCRI1 ELI RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL] on page 10-350 
0x420 DBGBVR2 EL1 RW 64-bit Debug Breakpoint Value Register 2 ° 

0x428 DBGBCR2 EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-350 
0x430 DBGBVR3_ EL1 RW 64-bit Debug Breakpoint Value Register 3 °” 

0x438 DBGBCR3 EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL] on page 10-350 
0x440 DBGBVR4 EL1 RW 64-bit Debug Breakpoint Value Register 4 °” 

0x448 DBGBCR4 EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-350 
0x450 DBGBVRS EL1 RW 64-bit Debug Breakpoint Value Register 5“! 








ch See the ARM” Architecture Reference Manual ARMv8 for more information. 
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Table 10-3 AArch64 debug register summary (continued) 















































Offset Name Type Width Description 
0x458 DBGBCRS EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-350 
0x800 DBGWVRO EL1 RW 64-bit Debug Watchpoint Value Register 0° 
0x808 DBGWCRO ELI RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL1 on page 10-352 
0x810 DBGWVRI1 EL1 RW 64-bit Debug Watchpoint Value Register 1 ° 
0x818 DBGWCRI ELI RW 32-bit 10.4.2 Debug Watchpoint Control Registers, ELI on page 10-352 
0x820 DBGWVR2 EL1 RW 64-bit Debug Watchpoint Value Register 2° 
@x828 DBGWCR2 ELI RW 32-bit 10.4.2 Debug Watchpoint Control Registers, ELI on page 10-352 
0x830 DBGWVR3 EL1 RW 64-bit Debug Watchpoint Value Register 3 °” 
0x838 DBGWCR3 EL1 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL] on page 10-352 
@xFA@ DBGCLAIMSET EL1 RW 32-bit Debug Claim Tag Set Register °" 
@xFA4 DBGCLAIMCLR_EL1 RW 32-bit Debug Claim Tag Clear Register °” 
@xFB8 DBGAUTHSTATUS EL1 RO 32-bit Debug Authentication Status Register ° 
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10.4 AArch64 debug register descriptions 
This section describes the debug registers in AArch64 state. 


10.3 AArch64 debug register summary on page 10-348 provides cross-references to the individual 
registers. 


This section contains the following subsections: 
¢ 10.4.1 Debug Breakpoint Control Registers, EL] on page 10-350. 
¢ 10.4.2 Debug Watchpoint Control Registers, ELI on page 10-352. 


10.4.1 Debug Breakpoint Control Registers, EL1 


The DBGBCRn_ELIcharacteristics are: 


Purpose 
Holds control information for a breakpoint. Each DBGBVR_EL1 is associated with a 
DBGBCR_ ELI to form a Breakpoint Register Pair (BRP). DBGBVRn_ELI is associated with 
DBGBCRn_EL Ito form BRPn. 
Note 


The range of n for DBGBCRn_EL1 is 0 to 5. 








Usage constraints 
The accessibility to the DBGBCRn_EL1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





The external debug accessibility to the DBGBCRn_EL1 by condition code is: 





Off DLK OSLK EDAD SLK Default 





Error Error Error Error RO RW 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The DBGBCRn_EL1 is Common to Secure and Non-secure states and architecturally mapped 
to: 
e The AArch32 DBGBCRn registers. 
e The external DBGBCRn_ ELI registers. 


Attributes 
See the register summary in Table 10-3 AArch64 debug register summary on page 10-348. 


The debug logic reset value of a DBGBCRn_EL1 is UNKNOWN. 
The following figure shows the DBGBCRn_EL 1 bit assignments. 


31 24 23 20 19 1615 14 13 12 543210 
L- HMC 


Figure 10-2 DBGBCR 
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The following table shows the DBGBCRn_ELI bit assignments. 


Table 10-4 DBGBCRn_EL1 bit assignments 





Bits Name Function 





[31:24] - Reserved, RESO. 





[23:20] BT Breakpoint Type. This field controls the behavior of Breakpoint debug event generation. This includes the meaning 
of the value held in the associated DBGBVR, indicating whether it is an instruction address match or mismatch or a 
Context match. It also controls whether the breakpoint is linked to another breakpoint. The possible values are: 





0b0000 Unlinked instruction address match. 
@beee1 Linked instruction address match. 
0be010 Unlinked ContextIDR match. 

@bee11 Linked ContextIDR match. 

0be100 Unlinked instruction address mismatch. 
@be101 Linked instruction address mismatch. 
0b1000 Unlinked VMID match. 

@b1001 Linked VMID match. 

0b1010 Unlinked VMID + CONTEXTIDR match. 
@b1011 Linked VMID + CONTEXTIDR match. 


All other values are reserved. 
The field break down is: 
BT[0] Enable linking. 


BT[3,1] Base type. If the breakpoint is not context-aware, these bits are RESO. Otherwise, the possible values are: 


@bee Match address. 

@be1 Match context ID. 

0b10 Match VMID. 

0b11 Match VMID and context ID. 


BT[2] = Mismatch. This bit is ignored in AArch64 state, and in ELO if EL1 is using AArch64. If EL1 using 
AArch32 is not implemented, this bit is RESO. The address in DBGBVRn_EL1 is the address of an 
instruction to be stepped. 





[19:16] LBN Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of the Context- 
matching breakpoint linked to. 





[15:14] SSC Security State Control. Determines the Security states that a breakpoint debug event for breakpoint n is generated. 
This field must be interpreted along with the AMC and PMC fields. 


This field is used with the Higher Mode Control (HMC), and Privileged Mode Control (PMC), fields to determine 
the mode and Security states that can be tested. 


See the ARM” Architecture Reference Manual ARMv8 for possible values of the fields. 





[13] HMC Hyp Mode Control bit. Determines the debug perspective for deciding when a breakpoint debug event for breakpoint 
n is generated. This bit must be interpreted along with the SSC and PMC fields. 


This bit is used with the SSC and PMC fields to determine the mode and Security states that can be tested. 


See the ARM® Architecture Reference Manual ARMv8 for possible values of the fields. 





[12:9] - Reserved, RESO. 
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Table 10-4 DBGBCRn_EL1 bit assignments (continued) 





Bits Name Function 





[8:5] BAS“ Byte Address Select. Defines which halfwords a regular breakpoint matches, regardless of the instruction set and 
Execution state. A debugger must program this field as follows: 


0x3 Match the T32 instruction at DBGBVRn. 
@xC Match the T32 instruction at DBGBVRn+2. 
OxF Match the A64 or A32 instruction at DBGBVRn, or context match. 


All other values are reserved. 
Note 


ARMv8 does not support direct execution of Java bytecodes. BAS[3] and BAS[1] ignore writes and on reads return 
the values of BAS[2] and BAS[0] respectively. 











[4:3] - Reserved, RESO. 





[2:1] PMC Privileged Mode Control. Determines the Exception level or levels that a breakpoint debug event for breakpoint n is 
generated. This field must be interpreted along with the SSC and AMC fields. 


This field is used with the SSC and HMC fields to determine the mode and Security states that can be tested. 


See the ARM” Architecture Reference Manual ARMVé for possible values of the fields. 
Note 


Bits[2:1] has no effect for accesses made in Hyp mode. 











[0] E Enable breakpoint. This bit enables the BRP: 
0 BRP disabled. 
1 BRP enabled. 


A BRP never generates a Breakpoint debug event when it is disabled. 
Note 


The value of DBGBCR.E is UNKNOWN on reset. A debugger must ensure that DBGBCR.E has a defined value before 
it programs DBGDSCR.MDBGen and DBGDSCR.HDBGen to enable debug. 








To access the DBGBCRn_ELI in AArch64 state, read or write the register with: 


MRS <Xt>, DBGBCRN_EL1; Read Debug Breakpoint Control Register n 
MSR DBGBCRN_EL1, <Xt>; Write Debug Breakpoint Control Register n 


To access the DBGBCRn in AArch32 state, read or write the CP 14 register with: 


MRC p14, ©, <Rt>, c@, cn, 4; Read Debug Breakpoint Control Register n 
MCR p14, ©, <Rt>, c@, cn, 4; Write Debug Breakpoint Control Register n 


The DBGBCRn_ELI can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x4n8. 


10.4.2 Debug Watchpoint Control Registers, EL1 


The DBGWCRn_ELIcharacteristics are: 





ei See the ARM” Architecture Reference Manual ARMv8 for more information on how the BAS field is interpreted by hardware. 
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Purpose Holds control information for a watchpoint. Each DBGWCR_ EL] is associated with 
a DBGWVR_ELI to form a Watchpoint Register Pair (WRP). DBGWCRn_EL] is 
associated with DBGWVRn_ELI to form WRPn. 


Note 
The range of n for DBGBCRn_ELlis 0 to 3. 





Usage The accessibility to the DBGWCRn_ELI1 by Exception level is: 
constraints 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RW RW RW RW RW 





The external debug accessibility to the DBGWCRn_EL]1 by condition code is: 





Off DLK OSLK EDAD SLK Default 





Error Error Error Error RO RW 





Table 11-1 External register access conditions on page 11-398 describes the access 
conditions. 


Configurations The DBGWCRn_EL]1 is Common to Secure and Non-secure states and architecturally 
mapped to: 
e The AArch32 DBGWCR» registers. 
e The external DBGWCRn_ ELI registers. 


Attributes See the register summary in Table 10-3 AArch64 debug register summary 
on page 10-348. 


The debug logic reset value of a DBGWCR_EL]1 is UNKNOWN. 


The following figure shows the DBGWCRn_ELI bit assignments. 


29 28 2423 212019 16 15 14 13 12 5 43 2 1 0 
L wr L Hmc 


Figure 10-3 DBGWCR 
The following table shows the DBGWCRn_EL1 bit assignments. 


Table 10-5 DBGWCRn_EL1 bit assignments 





Bits Name Function 





[31:29] - Reserved, RESO. 





[28:24] MASK Address range mask. The processor supports watchpoint address range masking. This field can set a watchpoint on a 
range of addresses by masking lower order address bits out of the watchpoint comparison. The value of this field is 
the number of low order bits of the address that are masked off, except that values of 1 and 2 are reserved. 


See the ARM” Architecture Reference Manual ARMv8 for the meanings of watchpoint address range mask values. 





[23:21] - Reserved, RESO. 
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Table 10-5 DBGWCRn_EL1 bit assignments (continued) 





Bits Name Function 


[20] WT Watchpoint Type. This bit is set to 1 to link the watchpoint to a breakpoint to create a linked watchpoint that requires 
both data address matching and Context matching: 


0 Unlinked data address match. 
1 Linked data address match. 


When this bit is set to 1 the linked BRP number field indicates the BRP that this WRP is linked. See the ARM® 
Architecture Reference Manual ARMV8 for more information. 





[19:16] LBN Linked Breakpoint Number. If this watchpoint is programmed with the watchpoint type set to linked, then this field 
must be programmed with the number of the breakpoint that defines the Context match to be combined with data 
address comparison. Otherwise, this field must be programmed to 0b0000. 

Reading this register returns an UNKNOWN value for this field, and the generation of Watchpoint debug events is 

UNPREDICTABLE, if either: 

¢ This watchpoint does not have linking enabled and this field is not programmed to @x@. 

¢ This watchpoint has linking enabled and the breakpoint indicated by this field does not support Context 
matching, is not programmed for Context matching, or does not exist. 


See the ARM” Architecture Reference Manual ARMv8 for more information. 





[15:14] SSC Security State Control. This field enables the watchpoint to be conditional on the Security state of the processor. This 
field is used with the Hyp Mode Control (HMC) and Privileged Access Control (PAC) fields. 


See the ARM” Architecture Reference Manual ARMvVé for possible values of the fields, and the access modes and 
Security states that can be tested. 





[13] HMC Hyp Mode Control. This field is used with the Security State Control (SSC) and PAC fields. The value of 
DBGWCR.PAC has no effect for accesses made in Hyp mode. 


See the ARM” Architecture Reference Manual ARMv8 for possible values of the fields, and the access modes and 
Security states that can be tested. 





[12:5] BAS Byte Address Select. The processor implements an 8-bit Byte address select field, DBGWCR[12:5]. 
A DBGWVR is programmed with a word-aligned address. This field enables the watchpoint to hit only if certain 
bytes of the addressed word are accessed. The watchpoint hits if an access hits any byte being watched, even if: 
e The access size is larger than the size of the region being watched. 
¢ The access is unaligned, and the base address of the access is not in the same word of memory as the address in 
the DBGWVR. 
e The access size is smaller than the size of region being watched. 


See the ARM” Architecture Reference Manual ARMv8 for more information. 





[4:3] LSC  Load/store access control. This field enables watchpoint matching for the type of access. The possible values are: 








@bee Reserved. 
@be1 Match on any load, Load-Exclusive, or swap. 
@b10 Match on any store, Store-Exclusive, or swap. 
@b11 Match on all type of access. 
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Table 10-5 DBGWCRn_EL1 bit assignments (continued) 





Bits Name Function 





[2:1] PAC Privileged Access Control. This field enables watchpoint matching conditional on the mode of the processor. This 
field is used with the SSC and PAC fields. 
See the ARM” Architecture Reference Manual ARMvVé8 for possible values of the fields, and the access modes and 
Security states that can be tested. 
Note 
¢ For all cases the match refers to the privilege level of the access, not the mode of the processor. For example, if 
the watchpoint is configured to match only accesses at PL1 or higher, and the processor executes an LDRT 


instruction in a PL1 mode, the watchpoint does not match. 
e Permitted values of this field are not identical to those for the DBGBCR. In the DBGBCR the value @be0 








permitted. 
[0] E Watchpoint Enable. This bit enables the watchpoint: 
0 Watchpoint disabled. 
1 Watchpoint enabled. 


A watchpoint never generates a Watchpoint debug event when it is disabled. 
Note 


The value of DBGWCR.E is UNKNOWN on reset. A debugger must ensure that DBGWCR.E has a defined value 
before it programs DBGDSCR[15:14] to enable debug. 











To access the DBGWCRn in AArch32 state, read or write the CP14 register with: 


MRC p14, @, <Rt>, c@, cn, 7; Read Debug Watchpoint Control Register n 
MCR p14, @, <Rt>, c@, cn, 7; Write Debug Watchpoint Control Register n 


To access the DBGWCRn_ELI in AArch64 state, read or write the register with: 


MRS <Xt>, DBGWCRN_EL1; Read Debug Watchpoint Control Register n 
MSR DBGWCRN_EL1, <Xt>; Write Debug Watchpoint Control Register n 


The DBGWCRn_ELI can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x8n8. The range of n for DBGWCRn_ ELI is 0 to 3. 
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10.5 AArch32 debug register summary 


The following table summarizes the 32-bit and 64-bit debug control registers that are accessible in 
AArch32 state from the internal CP 14 interface. 


These registers are accessed by the MCR and MRC instructions in the order of CRn, op1, CRm, op2 or MCRR 
and MRRC instructions in the order of CRm, op1. 


The table also shows the offset address for the AArch32 registers that are accessible from the internal 
memory-mapped interface and the external debug interface. See 70.7 Memory-mapped register summary 
on page 10-362 for a complete list of registers accessible from the internal memory-mapped and the 
external debug interface. 


Table 10-6 AArch32 debug register summary 


































































































Offset CRn opi CRm op2 Name Type Width Description 

- c0 0 c0 0 DBGDIDR RO 32-bit 10.6.1 Debug ID Register on page 10-358 

- 2 DBGDTRRXext RW 32-bit Debug Data Transfer Register, Receive, External View 

0x400 4 DBGBVRO RW 32-bit Debug Breakpoint Value Register 0 ® 

0x408 5 DBGBCRO RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-350 

0x800 6 DBGWVRO RW 32-bit Debug Watchpoint Value Register 0 

0x808 7 DBGWCRO RW 32-bit 10.4.2 Debug Watchpoint Control Registers, ELI 
on page 10-352 

- cl 0 DBGDSCRint RO 32-bit Debug Status and Control Register, Internal View © 

0x410 4 DBGBVR1 RW 32-bit Debug Breakpoint Value Register 1 © 

0x418 5 DBGBCR1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-350 

0x810 6 DBGWVRI1 RW 32-bit Debug Watchpoint Value Register 1 ® 

0x818 7 DBGWCR1 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL1 
on page 10-352 

- c2 0 DBGDCCINT RW 32-bit Debug Comms Channel Interrupt Enable Register ©! 

- 2 DBGDSCRext RW 32-bit Debug Status and Control Register, External View ® 

0x420 4 DBGBVR2 RW 32-bit Debug Breakpoint Value Register 2 “! 

0x428 5 DBGBCR2 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-350 

0x820 6 DBGWVR2 RW 32-bit Debug Watchpoint Value Register 2 © 

0x828 7 DBGWCR2 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL1 


on page 10-352 








ej See the ARM” Architecture Reference Manual ARMv8 for more information. 
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Table 10-6 AArch32 debug register summary (continued) 



































































































































Offset CRn opi CRm op2 Name Type Width Description 
- c3 2 DBGDTRTXext RW 32-bit Debug Data Transfer Register, Transmit, External View © 
0x430 4 DBGBVR3 RW 32-bit Debug Breakpoint Value Register 3 “i 
0x438 5 DBGBCR3 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-350 
0x830 6 DBGWVR3 RW 32-bit Debug Watchpoint Value Register 3 ®Ì 
0x838 7 DBGWCR3 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL1 
on page 10-352 
0x440 c4 4 DBGBVR4 RW 32-bit Debug Breakpoint Value Register 4 ® 
0x448 5 DBGBCR4 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-350 
@x@8C c0 0 c5 0 DBGDTRTXint WO 32-bit Debug Data Transfer Register, Transmit, Internal View ° 
DBGDTRRXint RO 32-bit Debug Data Transfer Register, Receive, Internal View ® 
0x450 4 DBGBVR5 RW 32-bit Debug Breakpoint Value Register 5 © 
0x458 5 DBGBCRS RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 
on page 10-350 
- c6 0 DBGWFAR RW 32-bit Debug Watchpoint Fault Address Register®*, RESO. 
0x098 2 DBGOSECCR RW 32-bit Debug OS Lock Exception Catch Control Register © 
- c7 0 DBGVCR RW 32-bit Debug Vector Catch Register © 
- cl 0 c0 0 DBGDRAR[31:0] RO 32-bit Debug ROM Address Register © 
- - 0 cl - DBGDRAR[63:0] 64-bit 
0x300 cl 0 c0 4 DBGOSLAR WO 32-bit Debug OS Lock Access Register “ 
- cl 4 DBGOSLSR RO 32-bit Debug OS Lock Status Register “ 
- c3 4 DBGOSDLR RW 32-bit Debug OS Double Lock Register “i 
0x444 c4 1 DBGBXVR4 RW 32-bit Debug Breakpoint Extended Value Register 4“ 
0x310 4 DBGPRCR RW 32-bit Debug Power/Reset Control Register © 
0x454 c5 1 DBGBXVR5 RW 32-bit Debug Breakpoint Extended Value Register 5“ 
- c2 2 c0 0 DBGDSARJ31:0] RO 32-bit Debug Self Address Register”! RESO 
- - 0 c2 - DBGDSAR[63:0]®! 64-bit 
- c7 0 c0 7 DBGDEVID2 RO 32-bit Debug Device ID Register 2, RESO 
- cl 7 DBGDEVID1 RO 32-bit 10.6.2 Debug Device ID Register 1 on page 10-359 
- c2 7 DBGDEVID RO 32-bit 10.6.3 Debug Device ID Register on page 10-360 
OxFAQ c8 6 DBGCLAIMSET RW 32-bit Debug Claim Tag Set Register © 
@xFA4 c9 6 DBGCLAIMCLR RW 32-bit Debug Claim Tag Clear Register © 
OxFB8 cl4 6 DBGAUTHSTATUS RO 32-bit Debug Authentication Status Register ©! 
ek 


el 


Previously returned information about the address of the instruction that accessed a watchpoint address. This register is now deprecated and is RESO. 
Previously defined the offset from the base address defined in DBGDRAR of the physical base address of the debug registers for the processor. This register is now 


deprecated and RESO. 
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10.6 AArch32 debug register descriptions 
This section describes the debug registers in AArch32 state. 


10.5 AArch32 debug register summary on page 10-356 provides cross-references to the individual 
registers. 


This section contains the following subsections: 

e 10.6.1 Debug ID Register on page 10-358. 

e 10.6.2 Debug Device ID Register 1 on page 10-359. 
e 10.6.3 Debug Device ID Register on page 10-360. 


10.6.1 Debug ID Register 


The DBGDIDR characteristics are: 


Purpose Specifies: 
¢ The version of the Debug architecture that is implemented. 
e Some features of the debug implementation. 


Usage The accessibility to the DBGDIDR by Exception level is: 
constraints 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





RO RO RO RO RO RO 





Configurations The DBGDIDR is Common to Secure and Non-secure states. 


Attributes See the register summary in Zable 10-6 AArch32 debug register summary 
on page 10-356. 


The following figure shows the DBGDIDR bit assignments. 


28 27 24 23 20 19 16 15 14 13 12 11 0 


Res1 — L SE imp 
nSUHD_imp RESO 
Figure 10-4 DBGDIDR bit assignments 


The following table shows the DBGDIDR bit assignments. 


Table 10-7 DBGDIDR bit assignments 





Bits Name Function 


[31:28] WRPs The number of Watchpoint Register Pairs (WRPs) implemented. The number of implemented WRPs is one 
more than the value of this field. The value is: 


0x3 The processor implements 4 WRPs. 


This field has the same value as ID_AA64DFR0_EL1.WRPs. 





[27:24] BRPs The number of Breakpoint Register Pairs (BRPs) implemented. The number of implemented BRPs is one 
more than the value of this field. The value is: 


@x5 The processor implements 6 BRPs. 


This field has the same value as ID AA64DFRO_EL1.BRPs. 
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Table 10-7 DBGDIDR bit assignments (continued) 





Bits 


Name 


Function 





[23:20] 


CTX_CMPs_ The number of BRPs that can be used for Context matching. This is one more than the value of this field. The 


value is: 


@x1 The processor implements two Context matching breakpoints, breakpoints 4 and 5. 


This field has the same value as ID AA64DFRO_EL1.CTX_CMPs. 





[19:16] 


Version 


The Debug architecture version. 


0x6 The processor implements ARMv8 Debug architecture. 





Reserved, RES1. 





nSUHD imp Secure User Halting Debug not implemented bit. The value is: 


1 The processor does not implement Secure User Halting Debug. 





[13] 


Reserved, RESO. 








[12] 


SE _imp 


Security Extensions implemented bit. The value is: 


1 The processor implements Security Extensions. 





Reserved, RESO. 





10.6.2 


To access the DBGDIDR in AArch32 state, read or write the CP 14 register with: 


MRC p14, ©, <Rt>, c@, c@, ©; Read Debug ID Register 


Debug Device ID Register 1 


The DBGDEVID1 characteristics are: 


Purpose 
Adds to the information given by the DBGDIDR by describing other features of the debug 
implementation. 

Usage constraints 
The accessibility to the DBGDEVID1 by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 
- RO RO RO RO RO 





Configurations 
The DBGDEVID1 is Common to Secure and Non-secure states. 
Attributes 
See the register summary in Table 10-6 AArch32 debug register summary on page 10-356. 


The following figure shows the DBGDEVID1 bit assignments. 


31 4 3 0 


Figure 10-5 DBGDEVID1 bit assignments 
The following table shows the DBGDEVID1 bit assignments. 
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Table 10-8 DBGDEVID1 bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:0] PCSROffset Indicates the offset applied to PC samples returned by reads of EDPCSR. The value is: 


@x2 EDPCSR samples have no offset applied and do not sample the instruction set state in the AArch32 state. 





To access the DBGDEVID1 in AArch32 state, read the CP 14 register with: 


MRC p14, @, <Rt>, c7, c1, 47 Read Debug Device ID Register 1 


10.6.3 Debug Device ID Register 


The DBGDEVID characteristics are: 





Purpose Specifies the version of the Debug architecture is implemented, and some features of 
the debug implementation. 

Usage The accessibility to the DBGDEVID by Exception level is: 

constraints 


ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





Configurations The DBGDEVID is Common to Secure and Non-secure states. 


Attributes See the register summary in Table 10-6 AArch32 debug register summary 
on page 10-356. 


The following figure shows the DBGDEVID bit assignments. 


28 27 24 23 20 19 16 15 12 11 
ClDMask DoubleLock| VirtExtns |VectorCatch rd PCsample 
BPAddrMask — __wPAddrMask 


Figure 10-6 DBGDEVID bit assignments 
The following table shows the DBGDEVID bit assignments. 


Table 10-9 DBGDEVID bit assignments 





Bits Name Function 





[31:28] CIDMask Specifies the level of support for the Context ID matching breakpoint masking capability. This value is: 


Qx® Context ID masking is not implemented. 





[27:24] AuxRegs Specifies support for the Debug External Auxiliary Control Register. This value is: 


@x1 The processor supports Debug External Auxiliary Control Register. 





[23:20] DoubleLock Specifies support for the Debug OS Double Lock Register. This value is: 


@x1 The processor supports Debug OS Double Lock Register. 











[19:16] VirExtns Specifies whether EL2 is implemented. This value is: 
@x1 The processor implements EL2. 
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Table 10-9 DBGDEVID bit assignments (continued) 





Bits Name Function 





[15:12] VectorCatch Defines the form of the vector catch event implemented. This value is: 


0x0 The processor implements address matching form of vector catch. 





[11:8] BPAddrMask Indicates the level of support for the Immediate Virtual Address (TVA) matching breakpoint masking 
capability. This value is: 


@xF Breakpoint address masking not implemented. DBGBCRn[28:24] are UNK/SBZP. 





[7:4] | WPAddrMask Indicates the level of support for the DVA matching watchpoint masking capability. This value is: 


0x1 Watchpoint address mask implemented. 





[3:0] | PCSample Indicates the level of support for Program Counter sampling using debug registers 40 and 41. This value is: 


0x3 EDPCSR, EDCIDSR and EDVIDSR are implemented as debug registers 40, 41, and 42. 





To access the DBGDEVID in AArch32 state, read the CP 14 register with: 


MRC p14, ©, <Rt>, c7, c2, 7; Read Debug Device ID Register 0 
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10.7 Memory-mapped register summary 
The following table shows the offset address for the registers that are accessible from the internal 
memory-mapped interface or the external debug interface. 
Table 10-10 Memory-mapped debug register summary 
Offset Name Type Width Description 
@x@00-Ox@1C - - - Reserved 
0x020 EDESR RW 32-bit External Debug Event Status Register 
0x024 EDECR RW 32-bit External Debug Execution Control Register ®™ 
0x028-0X02C - - - Reserved 
0x030 EDWARIo RO 32-bit External Debug Watchpoint Address Register, low word ®™ 
0x034 EDWARhi RO 32-bit External Debug Watchpoint Address Register, high word ®™ 
@x@38-Ox@7C - - - Reserved 
0x080 DBGDTRRX_ELO RW 32-bit Debug Data Transfer Register, Receive ®™ 
0x084 EDITR WO 32-bit External Debug Instruction Transfer Register ®™ 
0x088 EDSCR RW 32-bit External Debug Status and Control Register ®™ 
@x@8C DBGDTRTX_ELO RW 32-bit Debug Data Transfer Register, Transmit ®™ 
0x090 EDRCR WO 32-bit External Debug Reserve Control Register ®™ 
0x094 EDACR RW 32-bit 10.8.2 External Debug Auxiliary Control Register on page 10-367. 
0x098 EDECCR RW 32-bit External Debug Exception Catch Control Register ®™ 
@x@9C - - - Reserved 
Ox0@AQ EDPCSRlo RO 32-bit External Debug Program Counter Sample Register, low word *™ 
Ox@A4 EDCIDSR RO 32-bit External Debug Context ID Sample Register ®™ 
Ox@A8 EDVIDSR RO 32-bit External Debug Virtual Context Sample Register °™ 
@x@AC EDPCSRhi RO 32-bit External Debug Program Counter Sample Register, high word ®™ 
@x@BO-Ox2FC - - - Reserved 
0x300 OSLAR_EL1 WO 32-bit Debug OS Lock Access Register ©” 
@x304-Ox30C - - - Reserved 
0x310 EDPRCR RW 32-bit External Debug Power/Reset Control Register ®™ 
0x314 EDPRSR RO 32-bit External Debug Processor Status Register ®™ 
@x318-Ox3FC - - - Reserved 
0x400 DBGBVRO_EL1[31:0] RW 32-bit Debug Breakpoint Value Register 0 ®™ 
0x404 DBGBVRO_EL1[63:32] 
0x408 DBGBCRO_EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-350 
@x40C - - - Reserved 








em See the ARM” Architecture Reference Manual ARMVé8 for more information. 





ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 


10-362 


Non-Confidential 


10 Debug 
10.7 Memory-mapped register summary 


Table 10-10 Memory-mapped debug register summary (continued) 











































































































Offset Name Type Width Description 

0x410 DBGBVR1_EL1[31:0] RW 32-bit Debug Breakpoint Value Register 1 °™ 

0x414 DBGBVR1_EL1[63:32] 

0x418 DBGBCR1_EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-350 
@x41C - - - Reserved 

0x420 DBGBVR2_EL1[31:0] RW 32-bit Debug Breakpoint Value Register 2 ®™ 

0x424 DBGBVR2_EL1[63:32] 

0x428 DBGBCR2_EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, ELI on page 10-350 
@x42C - - - Reserved 

0x430 DBGBVR3_EL1[31:0] RW 32-bit Debug Breakpoint Value Register 3 ®™ 

0x434 DBGBVR3_EL1[63:32] 

0x438 DBGBCR3_EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, ELI on page 10-350 
@x43C = - - Reserved 

0x440 DBGBVR4 EL1[31:0] RW 32-bit Debug Breakpoint Value Register 4 °™ 

0x444 DBGBVR4_EL1[63:32] 

0x448 DBGBCR4_EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, ELI on page 10-350 
@x44C - - - Reserved 

0x450 DBGBVR5_EL1[31:0] RW 32-bit Debug Breakpoint Value Register 5°” 

0x454 DBGBVR5_EL1[63:32] 

0x458 DBGBCR5_EL1 RW 32-bit 10.4.1 Debug Breakpoint Control Registers, EL1 on page 10-350 
@x45C-Ox7FC - - - Reserved 

0x800 DBGWVRO_EL1[31:0] RW 32-bit Debug Watchpoint Value Register 0 °™ 

0x804 DBGWVRO_EL1[63:32] 

0x808 DBGWCRO _EL1 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, ELI on page 10-352 
@x8@C - - - Reserved 

0x810 DBGWVR1_EL1[31:0] RW 32-bit Debug Watchpoint Value Register 1 ®™ 

0x814 DBGWVR1_EL1[63:32] 

0x818 DBGWCR1_EL1 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL1 on page 10-352 
@x81C = - - Reserved 

0x820 DBGWVR2_EL1[31:0] RW 32-bit Debug Watchpoint Value Register 2 ®™ 

0x824 DBGWVR2_EL1[63:32] 

0x828 DBGWCR2_EL1 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL] on page 10-352 
@x82C - - - Reserved 

0x830 DBGWVR3_EL1[31:0] RW 32-bit Debug Watchpoint Value Register 3 ®™ 

0x834 DBGWVR3_EL1[63:32] 

0x838 DBGWCR3_EL1 RW 32-bit 10.4.2 Debug Watchpoint Control Registers, EL] on page 10-352 
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Table 10-10 Memory-mapped debug register summary (continued) 








Offset Name Type Width Description 
@x83C-OxCFC - - - Reserved 
oxD0O MIDR_EL1 RO (32-bit 4.3.1 Main ID Register, ELI on page 4-89 





@xD04-8xD1C 


Reserved 

























































































@xD20 ID_AA64PFRO_EL1[31:0] RO 32-bit 4.3.18 AArch64 Processor Feature Register 0, ELI on page 4-111 
@xD24 ID_AA64PFRO_EL1[63:32] RO 32-bit 
@xD28 ID_AA64DFRO_EL1[31:0] RO 32-bit 4.3.19 AArch64 Debug Feature Register 0, EL] on page 4-113 
@xD2C ID_AA64DFRO_EL1[63:32] RO 32-bit 
@xD30 ID_AA64ISARO EL1[31:0] RO 32-bit 4.3.20 AArch64 Instruction Set Attribute Register 0, EL1 
exD34 ID_AA64ISARO EL1[63:32] RO 32bit NPAse 4 114 
@xD38 ID_AA64MMEFRO EL1[31:0] RO 32-bit 4.3.21 AArch64 Memory Model Feature Register 0, ELI 
@xD3C ID_AA64MMFRO FL1[63:32] RO 32-bit ON PAE 4115 
@xD40 ID_AA64PFR1_EL1[31:0] RO 32-bit +~AArch64 Processor Feature Register 1 low word, RESO 
@xD44 ID_AA64PFR1_EL1[63:32] RO 32-bit +~AArch64 Processor Feature Register 1 high word, RESO 
@xD48 ID_AA64DFR1_EL1[31:0] RO 32-bit +AArch64 Debug Feature Register 1 low word, RESO 
@xD4C ID_AA64DFR1_EL1[63:32] RO 32-bit AArch64 Debug Feature Register 1 high word, RESO 
@xD590 ID_AA64ISARI EL1[31:0] RO 32-bit AArch64 Instruction Set Attribute Register 1 low word, RESO 
@xD54 ID_AA64ISAR1_EL1[63:32] RO 32-bit AArch64 Instruction Set Attribute Register 1 high word, RESO 
@xD58 ID_AA64MMEFR1 EL1[31:0] RO 32-bit AArch64 Memory Model Feature Register 1 low word, RESO 
@xD5C ID_AA64MMEFR1 EL1[63:32] RO 32-bit +AArch64 Memory Model Feature Register 1 high word, RESO 
@xD60-OxEF4 - - - Reserved 
OxEF8 EDITOCTRL WO 32-bit 10.8.3 External Debug Integration Output Control Register 
on page 10-368 
@xEFC EDITISR RO 32-bit 10.8.4 External Debug Integration Input Status Register 
on page 10-369 
OxFeO EDITCTRL RW 32-bit 10.8.5 External Debug Integration Mode Control Register 
on page 10-370 
OxFQ4-OxF9C - - - Reserved 
OxFAQ DBGCLAIMSET ELI RW 32-bit Debug Claim Tag Set Register ©” 
OxFA4 DBGCLAIMCLR EL1 RW 32-bit Debug Claim Tag Clear Register ®™ 
OxFA8 EDDEVAFFO RO 32-bit External Debug Device Affinity Register 0. See 4.3.2 Multiprocessor 
Affinity Register, EL] on page 4-90 
@xFAC EDDEVAFF1 RO 32-bit External Debug Device Affinity Register 1, RESO 
OxFB@ EDLAR WO 32-bit External Debug Lock Access Register ©” 
OxFB4 EDLSR RO 32-bit External Debug Lock Status Register ®™ 
OxFB8 DBGAUTHSTATUS EL1 RO 32-bit Debug Authentication Status Register ®™ 
@xFBC EDDEVARCH RO 32-bit External Debug Device Architecture Register ©™ 
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Table 10-10 Memory-mapped debug register summary (continued) 





















































Offset Name Type Width Description 

@xFCO EDDEVID2 RO 32-bit External Debug Device ID Register 2, RESO 

@xFC4 EDDEVID1 RO 32-bit 10.8.6 External Debug Device ID Register 1 on page 10-371 

@xFC8 EDDEVID RO 32-bit 10.8.7 External Debug Device ID Register 0 on page 10-371 

@xFCC EDDEVTYPE RO 32-bit External Debug Device Type Register ®™ 

@xFDO EDPIDR4 RO 32-bit External Debug Peripheral Identification Register 4 on page 10-376 

@xFD4-@xFDC EDPIDR5-7 RO 32-bit External Debug Peripheral Identification Register 5-7 

on page 10-376 

OxFEO EDPIDRO RO 32-bit External Debug Peripheral Identification Register 0 on page 10-373 

OxFE4 EDPIDR1 RO 32-bit External Debug Peripheral Identification Register 1 on page 10-373 

OxFE8 EDPIDR2 RO 32-bit External Debug Peripheral Identification Register 2 on page 10-374 

OxFEC EDPIDR3 RO 32-bit External Debug Peripheral Identification Register 3 on page 10-375 

OxFFO EDCIDRO RO 32-bit External Debug Component Identification Register 0 on page 10-377 

OxFF4 EDCIDR1 RO 32-bit External Debug Component Identification Register 1 on page 10-377 

OxFF8 EDCIDR2 RO 32-bit External Debug Component Identification Register 2 on page 10-378 

@xFFC EDCIDR3 RO 32-bit External Debug Component Identification Register 3 on page 10-379 
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10.8 Memory-mapped register descriptions 
This section describes the Cortex-A72 processor debug registers. 


10.7 Memory-mapped register summary on page 10-362 provides cross-references to the individual 
registers. 


This section contains the following subsections: 

e 10.8.1 External Debug Reserve Control Register on page 10-366. 

¢ 10.8.2 External Debug Auxiliary Control Register on page 10-367. 

¢ 10.8.3 External Debug Integration Output Control Register on page 10-368. 
¢ 10.8.4 External Debug Integration Input Status Register on page 10-369. 

¢ 10.8.5 External Debug Integration Mode Control Register on page 10-370. 
e 10.8.6 External Debug Device ID Register 1 on page 10-371. 

¢ 10.8.7 External Debug Device ID Register 0 on page 10-371. 

¢ 10.8.8 External Debug Peripheral Identification Registers on page 10-372. 
¢ 10.8.9 External Debug Component Identification Registers on page 10-376. 


10.8.1 External Debug Reserve Control Register 
The EDRCR characteristics are: 


Purpose Used to cancel bus requests and clear sticky bits in the EDSCR. 
Usage Accessible through the internal memory-mapped interface and the external debug 
constraints interface. The access conditions are: 


Off DLK OSLK EDAD SLK Default 





ERROR ERROR ERROR - WI WO 





Table 10-1 External register access conditions on page 10-347 describes the access 
conditions. 


Configurations The EDRCR is in the Core power domain. 


Attributes See the register summary in Table 10-10 Memory-mapped debug register summary 
on page 10-362. 


The following figure shows the EDRCR bit assignments. 


31 543210 


Cancel Bus Requests Request — 
Clear Sticky Pipeline Advance 
Clear Sticky Error 


Figure 10-7 EDRCR bit assignments 
The following table shows the EDRCR bit assignments. 


Table 10-11 EDRCR bit assignments 





Bits Name Function 





[31:5] - Reserved, RESO. 





[4] CBRRQ Reserved.RESO. 
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Table 10-11 EDRCR bit assignments (continued) 





Bits Name Function 





[3] CSPA Clear Sticky Pipeline Advance. This bit is used to clear the EDSCR.PipeAdv bit to 0. The possible values are: 


0 No action. 
1 Clear the EDSCR.PipeAdv bit to 0. 





[2] CSE Clear Sticky Error. Used to clear the EDSCR cumulative error bits to 0. The possible values: 


0 No action. 
1 Clear the EDSCR. {TXU, RXO, ERR} bits, and, if the processor is in Debug state, the EDSCR.ITO bit, to 0. 





[1:0] - Reserved, RESO. 





10.8.2 External Debug Auxiliary Control Register 


The EDACR characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED configuration and control options. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EDAD SLK Default 





- RO RW 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDACR is in the Debug power domain. 
Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDACR bit assignments. 


31 1 0 


RESO a 


Override idle acknowledgement — 
Core debug reset status 
Debug powerdown override 


Debug clock stop control 


nN 
wo 
N 


+ 


Figure 10-8 EDACR bit assignments 


The following table shows the EDACR bit assignments. 
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Table 10-12 EDACR bit assignments 





Bits Name 


Function 





[31:4] - 


Reserved, RESO. 





[3] Override idle 
Acknowledgment 


Override idle Acknowledgment signal to processor. The possible values are: 
0 Processor waits for the debug register access logic to go idle before it enters the idle state. 
This is the reset value. 


1 Processor does not wait for the debug register access logic to go idle before it enters the idle 
state. 





[2] Core debug reset status 


Read-only status bit that reflects the current reset state of the debug logic in the processor power 
domain: 


0 Debug logic in processor power domain is not in reset state. 


1 Debug logic in processor power domain is currently in reset state. 





[1] Debug powerdown 
override 


Debug powerdown control bit. If debug is enabled and this bit is: 


0 Error response is generated for APB accesses to the processor domain debug registers when 
the processor is powered down or OS Double Lock is set. This is the reset value. 


1 APB accesses to the processor domain debug registers proceed normally when the processor 
is powered down or OS Double Lock is set. 





[0] Debug clock stop control 


Debug clock control bit. If debug is enabled and this bit is: 


0 Does not prevent the clock generator from stopping the processor clock. This is the reset 
value. 


1 Prevents the clock generator from stopping the processor clock. 





10.8.3 External Debug Integration Output Control Register 


The EDITOCTRL characteristics are: 


Purpose 


Controls signal outputs when EDITCTRL.IME is set. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





Error Error Error - WI WO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
EDITOCTRL is in the Core power domain. 


Attributes 


See 10.7 Memory-mapped register summary on page 10-362. 
The following figure shows the EDITOCTRL bit assignments. 
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31 3.2 1 0 


nPMUIRQ 
CTI PMUIRQ 
CTI DBGTRIGGER 
Figure 10-9 EDITOCTRL bit assignments 


The following table shows the EDITOCTRL bit assignments. 


Table 10-13 EDITOCTRL bit assignments 











Bits Name Function 

[31:3] - Reserved, RESO. 

[2] nPMUIRQ Controls the nPMUIRQ output. When this bit is set to 1, the corresponding nPMUIRQ signal goes 
LOW. The reset value is 0. 

[1] CTI PMUIRQ Controls the internal signal equivalent to PMUIRQ that goes from the PMU to the CTI. The reset value 
is 0. 





[0] CTI DBGTRIGGER Controls the internal signal equivalent to DBGTRIGGER that goes from the Debug unit to the CTI. 
The reset value is 0. 





Related information 
10.8.5 External Debug Integration Mode Control Register on page 10-370. 


10.8.4 External Debug Integration Input Status Register 


The EDITISR characteristics are: 
Purpose 
Enables the values of signal inputs to be read when EDITCTRL.IME is set. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 


Off DLK OSLK EDAD SLK Default 





Error Error Error - - RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
EDITISR is in the Core power domain. 
Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDITISR bit assignments. 
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31 3.2 1 0 


CTI DBGRESTART 
CTI EDBGRQ 
EDBGRQ 
Figure 10-10 EDITISR bit assignments 


The following table shows the EDITISR bit assignments. 


Table 10-14 EDITISR bit assignments 





Bits Name Function 


[31:3] - Reserved, RESO. 





[2] CTI DBGRESTART CTI debug restart bit. This bit reads the state of the debug restart input coming from the CTI into the 








debug unit. 

[1] CTI EDBGRQ CTI debug request bit. This bit reads the state of the debug request input coming from the CTI into the 
debug unit. 

[0] EDBGRQ This bit reads the state of the EDBGRQ input. 





Related information 
10.8.5 External Debug Integration Mode Control Register on page 10-370. 


10.8.5 External Debug Integration Mode Control Register 


The EDITCTRL characteristics are: 


Purpose 
Enables the external debug to switch from its default mode into integration mode, where test 


software can control directly the inputs and outputs of the processor, for integration testing or 
topology detection. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 


Off DLK OSLK EDAD SLK Default 





Error Error Error - RO RW 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
EDITCTRL is in the Core power domain. 
Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDITCTRL bit assignments. 


31 1 0 
memes O O 
IME— 


Figure 10-11 EDITCTRL bit assignments 
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The following table shows the EDITCTRL bit assignments. 
Table 10-15 EDITCTRL bit assignments 





Bits Name Function 





[31:1] - Reserved, RESO. 





[0] IME When IME is set to 1, the device reverts to an integration mode to enable integration testing or topology detection: 


0 Normal operation. 


1 Integration mode enabled. 





10.8.6 External Debug Device ID Register 1 


The EDDEVID!1 characteristics are: 
Purpose 
Provides extra information for external debuggers about features of the debug implementation. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EDAD SLK Default 





5 ‘ - RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDDEVID1 is in the Debug power domain. 


Attributes 
See 10.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDDEVID1 bit assignments. 
31 4 3 0 


Figure 10-12 EDDEVID1 bit assignments 


The following table shows the EDDEVID1 bit assignments. 
Table 10-16 EDDEVID1 bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:0] PCSROffset Indicates the offset applied to PC samples returned by reads of EDPCSR. For ARMV8 the value is: 


@x2 EDPCSR samples have no offset applied and do not sample the instruction set state in AArch32 state. 





10.8.7 External Debug Device ID Register 0 


The EDDEVID characteristics are: 


Purpose 
Provides extra information for external debuggers about features of the debug implementation. 
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Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





Ss & © £ JRO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDDEVID is in the Debug power domain. 
Attributes 
See 10.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDDEVID bit assignments. 


31 28 27 24 23 4 3 0 


Figure 10-13 EDDEVID bit assignments 
The following table shows the EDDEVID bit assignments. 


Table 10-17 EDDEVID bit assignments 





Bits Name Function 





[31:28] - Reserved, RESO. 





[27:24] AuxRegs Indicates support for auxiliary registers. The possible values are: 


@x1 External Debug Auxiliary Control Register, EDACR, is implemented. 





[23:4] - Reserved, RESO. 





[3:0] | PC Sample Indicates the level of sample-based profiling support using external debug registers 40 through 43. Valid values 
of this field in v8-A are: 


0x3 EDPCSR, EDCIDSR, and EDVIDSR are implemented. 





10.8.8 External Debug Peripheral Identification Registers 


The External Debug Peripheral Identification Registers provide standard information required for all 
components that conform to the ARM® Debug Interface Architecture Specification ADIv5.0 to ADIVS.2. 
They are a set of eight registers, listed in register number order in the following table. 


Table 10-18 Summary of the External Debug Peripheral Identification Registers 





Register Value Offset 





EDPIDR4 0x04 @xFDO 





EDPIDRS5 0x00 @xFD4 





EDPIDR6 0x00 OxFD8 





EDPIDR7 0x00 @xFDC 





EDPIDRO 0x08 ®xFE®@ 





EDPIDR1 @xBD @xFE4 
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Table 10-18 Summary of the External Debug Peripheral Identification Registers (continued) 





Register Value Offset 





EDPIDR2 @x@B @OxFE8 





EDPIDR3 0x00 @xFEC 





Only bits[7:0] of each External Debug Peripheral ID Register are used, with bits[3 1:8] reserved. 
Together, the eight External Debug Peripheral ID Registers define a single 64-bit Peripheral ID. 


The External Debug Peripheral ID registers are: 

¢ External Debug Peripheral Identification Register 0 on page 10-373. 

e External Debug Peripheral Identification Register 1 on page 10-373. 

¢ External Debug Peripheral Identification Register 2 on page 10-374. 

e External Debug Peripheral Identification Register 3 on page 10-375. 

¢ External Debug Peripheral Identification Register 4 on page 10-376. 

¢ External Debug Peripheral Identification Register 5-7 on page 10-376. 


External Debug Peripheral Identification Register 0 
The EDPIDRO characteristics are: 


Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





zoa & = i RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDPIDR0O is in the Debug power domain. 
Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDPIDRO bit assignments. 


31 8 7 0 


Figure 10-14 EDPIDRO bit assignments 
The following table shows the EDPIDRO bit assignments. 


Table 10-19 EDPIDRO bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO. 





[7:0] Part 0 @xø8 Least significant byte of the debug part number. 





External Debug Peripheral Identification Register 1 
The EDPIDR1 characteristics are: 
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Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





co ok e om x RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDPIDR1 is in the Debug power domain. 
Attributes 
See 10.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDPIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 10-15 EDPIDR1 bit assignments 
The following table shows the EDPIDR1 bit assignments. 


Table 10-20 EDPIDR1 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] DES_0 xB ARM Limited. This is the least significant nibble of JEP106 ID code. 





[5:0] Part_l xp Most significant nibble of the debug part number. 





External Debug Peripheral Identification Register 2 
The EDPIDR2 characteristics are: 


Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





nn: 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDPIDR2 is in the Debug power domain. 
Attributes 
See 10.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDPIDR2 bit assignments. 
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31 8 7 432 0 
JEDEC — 


Figure 10-16 EDPIDR2 bit assignments 
The following table shows the EDPIDR2 bit assignments. 


Table 10-21 EDPIDR2 bit assignments 
































Bits Name Function 
[31:8] - Reserved, RESO. 
[7:4] Revision øxø Part major revision. 
[3] JEDEC @b1 RAO. Indicates a JEP 106 identity code is used. 
[2:0] DES_1 @bø11 ARM Limited. This is the most significant nibble of JEP106 ID code. 
External Debug Peripheral Identification Register 3 
The EDPIDR3 characteristics are: 
Purpose 
Provides information to identify an external debug component. 
Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 
Off DLK OSLK EDAD SLK Default 
soh & 3 - RO 
Table 11-1 External register access conditions on page 11-398 describes the access conditions. 
Configurations 
The EDPIDR3 is in the Debug power domain. 
Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 
The following figure shows the EDPIDR3 bit assignments. 
31 8 7 4 3 0 
Figure 10-17 EDPIDR3 bit assignments 
The following table shows the EDPIDR3 bit assignments. 
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Table 10-22 EDPIDR3 bit assignments 





Bits Name Function 











[31:8] - Reserved, RESO. 
[7:4] REVAND @x@ Part minor revision. 
[3:0] CMOD @x® Customer modified. 





External Debug Peripheral Identification Register 4 
The EDPIDR4 characteristics are: 
Purpose 


Provides information to identify an external debug component. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EDAD SLK Default 





- - RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDPIDR4 is in the Debug power domain. 


Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDPIDR4 bit assignments. 
31 8 7 4 3 0 


Figure 10-18 EDPIDR4 bit assignments 
The following table shows the EDPIDR4 bit assignments. 


Table 10-23 EDPIDR4 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] Size @x@ Size of the component. Log2 the number of 4KB pages from the start of the component to the end of the 
component ID registers. 





[3:0] DES_2 9x4 ARM Limited. This is the least significant nibble JEP106 continuation code. 





External Debug Peripheral Identification Register 5-7 


No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. They are 
reserved for future use and are RESO. 


10.8.9 External Debug Component Identification Registers 


There are four read-only External Debug Component Identification Registers, Debug Component IDO 
through Debug Component ID3. The following table shows these registers. 
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Table 10-24 Summary of the External Debug Component Identification Registers 





Register Value Offset 





Component IDO @x@D @xFF@ 





Component ID1 0x90 @xFF4 





Component ID2 0x05 O@xFF8 





Component ID3 @xB1 @xFFC 





The External Debug Component Identification Registers identify Debug as an ARM Debug Interface v5 
component. The External Debug Component ID registers are: 

e External Debug Component Identification Register 0 on page 10-377. 

e External Debug Component Identification Register 1 on page 10-377. 

e External Debug Component Identification Register 2 on page 10-378. 

e External Debug Component Identification Register 3 on page 10-379. 


External Debug Component Identification Register 0 
The EDCIDRO characteristics are: 
Purpose 


Provides information to identify an external debug component. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EDAD SLK Default 





- - RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDCIDRO is in the Debug power domain. 


Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDCIDRO bit assignments. 
31 8 7 0 


Figure 10-19 EDCIDRO bit assignments 


The following table shows the EDCIDR0O bit assignments. 
Table 10-25 EDCIDRO bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO. 
[7:0] PRMBL_0 gxep Preamble byte 0. 





External Debug Component Identification Register 1 


The EDCIDR1 characteristics are: 
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Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





Sf = > sk RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDCIDR1 is in the Debug power domain. 
Attributes 
See 10.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDCIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 10-20 EDCIDR1 bit assignments 
The following table shows the EDCIDR1 bit assignments. 


Table 10-26 EDCIDR1 bit assignments 














Bits Name Function 

[31:8] - Reserved, RESO. 

[7:4] CLASS 0x9 Debug component. 
[3:0] PRMBL 1 øxø Preamble. 





External Debug Component Identification Register 2 
The EDCIDR2 characteristics are: 


Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





Sie ek «x « RÖ 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDCIDR2 is in the Debug power domain. 
Attributes 
See 10.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDCIDR2 bit assignments. 
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31 8 7 0 


Figure 10-21 EDCIDR2 bit assignments 


The following table shows the EDCIDR2 bit assignments. 
Table 10-27 EDCIDR2 bit assignments 








Bits Name Function 
[31:8] - Reserved, RESO. 
[7:0] PRMBL 2 9x@5 Preamble byte 2. 





External Debug Component Identification Register 3 
The EDCIDR3 characteristics are: 
Purpose 


Provides information to identify an external debug component. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EDAD SLK Default 





b = 6 ‘=. & RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The EDCIDR3 is in the Debug power domain. 


Attributes 
See 70.7 Memory-mapped register summary on page 10-362. 


The following figure shows the EDCIDR3 bit assignments. 
31 8 7 0 


Figure 10-22 EDCIDR3 bit assignments 


The following table shows the EDCIDR3 bit assignments. 
Table 10-28 EDCIDR3 bit assignments 

















Bits Name Function 

[31:8] - Reserved, RESO. 

[7:0] PRMBL 3 øxB1 Preamble byte 3. 
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10.9 Debug events 
Describes debug events in the processor. 
A debug event can be either: 


e A software debug event. 
e A halting debug event. 


A processor responds to a debug event in one of the following ways: 
e Ignores the debug event. 

e Takes a debug exception. 

¢ Enters Debug state. 


See the ARM® Architecture Reference Manual ARMV8 for more information on debug events. 


This section contains the following subsections: 
e 10.9.1 Watchpoint debug events on page 10-380. 
e 10.9.2 Debug OS Lock on page 10-380. 


10.9.1 Watchpoint debug events 


In the Cortex-A72 processor, watchpoint debug events are always synchronous. Memory hint 
instructions and cache clean operations, except DC ZVA, DC IVAC, and DC IVAU do not generate 
watchpoint debug events. Store exclusive instructions generate a watchpoint debug event even when the 
check for the control of exclusive monitor fails. 


For watchpoint debug events, the value reported in DFAR is guaranteed to be no lower than the address 
of the watchpointed location rounded down to a multiple of 16 bytes. 


10.9.2 Debug OS Lock 


Debug OS Lock is set by the powerup reset, nhCPUPORESET. For normal behavior of debug events and 
debug register accesses, Debug OS Lock must be cleared. For more information, see the ARM® 
Architecture Reference Manual ARMV8. 


Related information 
2.3.2 Resets on page 2-36. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 10-380 
Non-Confidential 


10.10 


External debug interface 


10 Debug 


10.10 External debug interface 


The system can access memory-mapped debug registers through the APB interface. 


The APB interface is compliant with the AMBA 3 APB interface. 


The following figure shows the debug interface implemented in the Cortex-A72 processor. For more 


information on these signals, see the ARM® CoreSight 


Authentication 


This section contains the following subsections: 
e 10.10.1 Debug memory map on page 10-381. 


interface 
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controller 
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Figure 10-23 External debug interface, including APBv3 slave port 


e 10.10.2 DBGPWRDUP debug signal on page 10-382. 


e 10.10.3 DBGLIRSTDISABLE debug signal on page 10-382. 
e 10.10.4 Changing the authentication signals on page 10-383. 


10.10.1 


Debug memory map 


The memory map supports up to four cores in a cluster. The following table shows the address mapping 
for the debug trace components. 





en 


Table 10-29 Address mapping for debug trace components 


Indicates the mapped component if present, otherwise reserved. 





Address range 


0x000000 - OXOOFFFF 


Component ®™ 


ROM table 





Qx010000 - ƏOxXO1FFFF 


Core 0 Debug 





0x020000 - OxO2FFFF 


Core 0 CTI 





Qx030000 - OxO3FFFF 


Core 0 PMU 





Qx040000 - OxO4FFFF 


Core 0 Trace 





0x050000 - Ox1OFFFF 


Reserved 
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Table 10-29 Address mapping for debug trace components (continued) 





Address range 


Component “ 





Qx110000 - @x11FFFF 


Core 1 Debug 





@x120000 - @x12FFFF 


Core 1 CTI 





0x130000 - @x13FFFF 


Core 1 PMU 





Qx140000 - Ox14FFFF 


Core | Trace 





0x150000 - 0x20FFFF 


Reserved 





0x210000 - @x21FFFF 


Core 2 Debug 





Qx220000 - @x22FFFF 


Core 2 CTI 





0x230000 - Ox23FFFF 


Core 2 PMU 





0x240000 - Ox24FFFF 


Core 2 Trace 





0x250000 - Ox3@FFFF 


Reserved 





0x310000 - 8x31 FFFF 


Core 3 Debug 





Qx320000 - @x32FFFF 


Core 3 CTI 





0x330000 - @x33FFFF 


Core 3 PMU 





0x340000 - Ox34FFFF 


Core 3 Trace 





0x350000 - Ox3FFFFF 


Reserved 





10.10.2 ©DBGPWRDUP debug signal 


This section describes the DBGPWRDUP debug input signal. 


DBGPWRDUP 


You must set the DBGPWRDUP signal LOW before removing power to the core domain. After power 
is restored to the core domain, the DBGPWRDUP signal must be asserted HIGH. The EDPRSR.PU bit 


reflects the value of this DBGPWRDUP signal. 
Note 





DBGPWRDUP must be tied HIGH if the particular implementation does not support separate core and 


debug power domains. 


10.10.3 DBGL1IRSTDISABLE debug signal 


When set HIGH, the DBGLIRSTDISABLE input signal disables the automatic hardware controlled 
invalidation of the L1 data cache after the processor is reset using nCORERESET or nCPUPORESET. 
It also disables the automatic hardware-controlled invalidation of the L2 snoop tag RAMs after the L2 is 


reset using nLZRESET. 


The DBGLIRSTDISABLE must be used only to assist debug of an external watchdog triggered reset 
by allowing the contents of the L1 data cache before the reset to be observable after the reset. If reset is 
asserted, while an L1 data cache eviction or L1 data cache fetch is performed, the accuracy of those 





en Indicates the mapped component if present, otherwise reserved. 
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cache entries is not guaranteed. Similarly, the contents of the L2 snoop tag RAMs might be observed 
following reset of the L2 if DBGLIRSTDISABLE is asserted before resetting the L2. 


You must not use the DBGLIRSTDISABLE signal to disable automatic hardware-controlled 
invalidation of the L1 data cache or the L2 snoop tag RAMs in normal processor powerup sequences. 
This is because synchronization of the L1 data cache invalidation sequence with the duplicate L1 tags in 
the Level 2 Memory System is not guaranteed. 


The DBGLIRSTDISABLE signal applies to all processors in the multiprocessor. Each processor 
samples the signal when nCORERESET or nCPUPORESET is asserted. The L2 samples the signal 
when nL2RESET is asserted. 


If the functionality offered by the DBGLIRSTDISABLE input signal is not required, the input must be 
tied to LOW. 


10.10.4 Changing the authentication signals 


The NIDEN, DBGEN, SPIDEN, and SPNIDEN input signals are either tied off to some fixed value or 
controlled by some external device. 


If software running on the processor has control over an external device that drives the authentication 

signals, it must make the change using a safe sequence: 

1. Execute an implementation-specific sequence of instructions to change the signal value. For example, 
this might be a single STR instruction that writes certain value to a control register in a system 
peripheral. 

2. Ifthe prior step involves any memory operation, issue a DSB instruction. 

3. Poll the DBGAUTHSTATUS_ ELI register to check whether the processor has already detected the 
changed value of these signals. This is required because the system might not issue the signal change 
to the processor until several cycles after the DSB instruction completes. 

4. Issue an ISB instruction or exception entry or exception return. 


The software cannot perform debug or analysis operations that depend on the new value of the 
authentication signals until this procedure is complete. The same rules apply when the debugger has 
control of the processor through the Instruction Transfer Register, EDITR, while in Debug state. The 
relevant combinations of the DBGEN, NIDEN, SPIDEN, and SPNIDEN values can be determined by 
polling DBGAUTHSTATUS_EL1. 
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This section provides details on the processor's ROM table. 


The Cortex-A72 processor includes a ROM table that complies with the ARM® CoreSight™ Architecture 
Specification. This table contains a list of components such as processor debug units, processor Cross 
Trigger Interfaces (CTIs), processor Performance Monitoring Units (PMUs) and processor Embedded 
Trace Macrocells (ETMs). Debuggers can use the ROM table to determine which components are 
implemented inside the processor. 


If a component is not included in your configuration of the processor, the corresponding debug APB 
ROM table entry is still present but the component is marked as not present. 


This section contains the following subsections: 

e 10.11.1 ROM table register interface on page 10-384. 

e 10.11.2 ROM table register summary on page 10-384. 

e 10.11.3 ROM table register descriptions on page 10-385. 

e 10.11.4 ROM table Debug Peripheral Identification Registers on page 10-387. 
e 10.11.5 ROM table Debug Component Identification Registers on page 10-391. 


10.11.1 ROM table register interface 


The interface to the ROM table entries is the APB slave port. 


Related information 
10.10 External debug interface on page 10-381. 


10.11.2 ROM table register summary 


The following table shows the offsets from the physical base address of the ROM table. 


Table 10-30 ROM table registers 






























































Offset Name Type Description 
0x000 ROMENTRYO RO _ Core 0 Debug, see ROM entry registers on page 10-385 
0x004 ROMENTRY1 RO _ Core 0 CTI, see ROM entry registers on page 10-385 
0x008 ROMENTRY2 RO Core 0 PMU, see ROM entry registers on page 10-385 
Ox0OC ROMENTRY3 RO Core 0 ETM, see ROM entry registers on page 10-385 
0x010 ROMENTRY4 RO Core 1 Debug, see ROM entry registers on page 10-385 
0x014 ROMENTRY5 RO Core 1 CTI, see ROM entry registers on page 10-385 
0x018 ROMENTRY6 RO Core 1 PMU, see ROM entry registers on page 10-385 
Ox01C ROMENTRY7 RO Core 1 ETM, see ROM entry registers on page 10-385 
0x020 ROMENTRY8 RO Core 2 Debug, see ROM entry registers on page 10-385 
0x024 ROMENTRY9 RO Core 2 CTI, see ROM entry registers on page 10-385 
0x028 ROMENTRY10 RO Core 2 PMU, see ROM entry registers on page 10-385 
0x02C ROMENTRY11 RO Core 2 ETM, see ROM entry registers on page 10-385 
0x030 ROMENTRY12 RO Core 3 Debug, see ROM entry registers on page 10-385 
0x034 ROMENTRY13 RO Core 3 CTI, see ROM entry registers on page 10-385 
ARM 100095_0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 10-384 


Non-Confidential 


10 Debug 
10.11 ROM table 


Table 10-30 ROM table registers (continued) 





















































Offset Name Type Description 

0x038 ROMENTRY14 RO Core 3 PMU, see ROM entry registers on page 10-385 

0x03C ROMENTRY15 RO Core 3 ETM, see ROM entry registers on page 10-385 

0x040-ƏxXFCC - RO Reserved, RES0 

@xFDO ROMPIDR4 RO ROM table Debug Peripheral Identification Register 4 on page 10-390 
@xFD4 ROMPIDRS5 RO ROM table Debug Peripheral Identification Register 5-7 on page 10-391 
@xFD8 ROMPIDR6 RO 

@xFDC ROMPIDR7 RO 

OxFEO ROMPIDRO RO ROM table Debug Peripheral Identification Register 0 on page 10-387 
OxFE4 ROMPIDR1 RO ROM table Debug Peripheral Identification Register 1 on page 10-388 
OxFE8 ROMPIDR2 RO ROM table Debug Peripheral Identification Register 2 on page 10-389 
@xFEC ROMPIDR3 RO ROM table Debug Peripheral Identification Register 3 on page 10-390 
OxFFO ROMCIDRO RO ROM table Debug Component Identification Register 0 on page 10-392 
OxFF4 ROMCIDRI1 RO ROM table Debug Component Identification Register 1 on page 10-392 
OxFF8 ROMCIDR2 RO ROM table Debug Component Identification Register 2 on page 10-393 
@xFFC ROMCIDR3 RO ROM table Debug Component Identification Register 3 on page 10-393 





10.11.3 ROM table register descriptions 


This section describes the ROM table registers. /0.//.2 ROM table register summary on page 10-384 
provides cross-references to individual registers. 


ROM entry registers 
The characteristics of the ROMENTRY»n are: 


Purpose 


Usage 
constraints 


Configurations 
Attributes 


Indicates to a debugger whether the debug component is present in the processor's 
debug logic. There are 16 ROMENTRY registers in the Cortex-A72 processor. 


The accessibility to the ROMENTRYn by condition code is: 





Off DLK OSLK EDAD SLK Default 





- es « ££ ££ RO 





Table 11-1 External register access conditions on page 11-398 describes the access 
conditions. 


The ROMENTRYn is Common to Secure and Non-secure states. 
See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMENTRY bit assignments. 
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31 12 11 2 1 0 


ee o Œ 
Format — 
Component present 
Figure 10-24 ROMENTRY bit assignments 
The following table shows the ROMENTRY bit assignments. 


Table 10-31 ROMENTRY bit assignments 


Bits Name Function 





[31:12] Address offset Address offset for the debug component. 
Note 


Negative values of address offsets are permitted using the two’s complement of the offset. 

















[11:2] - Reserved, RESO. 
[1] Format Format of the ROM table entry. The value for all ROMENTRY registers is: 
0 End marker. 
1 32-bit format. 
[0] Component present®® Indicates whether the component is present: 
0 Component is not present. 
1 Component is present. 





The Physical Address of a debug component is determined by shifting the address offset 12 places to the 
left and adding the result to Physical Address of processor ROM table. 


The following table shows the offset values for all ROMENTRY values. If a processor is not 
implemented, the ROMENTRY registers for its debug, CTI, PMU, and ETM components are 
0x00000000. 


Table 10-32 ROMENTRY values 


















































Name Debug component Offset value ROMENTRY value 
ROMENTRYO Core 0 Debug 0x00010 0x00010003 
ROMENTRY1 Core 0 CTI 0x00020 0x00020003 
ROMENTRY2 Core 0 PMU 0x00030 0x00030003 
ROMENTRY3 Core 0 ETM 0x00040 0x00040003 
ROMENTRY4 Core 1 Debug 0x00110 0x00110003 
ROMENTRY5 Core 1 CTI 0x00120 0x00120003°P 
ROMENTRY6 Core 1 PMU 0x00130 0x00130003°P 
ROMENTRY7 Core 1 ETM 0x00140 0x00140003°P 
ROMENTRY8 Core 2 Debug 0x00210 0x00210003°P 

eo core 0 is always present. The component entries for core 1, 2, and 3 depend on your configuration. 

eP If the component is present. 
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10.11 ROM table 


Table 10-32 ROMENTRY values (continued) 


























Name Debug component Offset value ROMENTRY value 
ROMENTRY9 Core 2 CTI 0x00220 0x00220003°P 
ROMENTRY10 Core 2 PMU 0x00230 0x00230003°P 
ROMENTRY11 Core 2 ETM 0x00240 0x00240003°P 
ROMENTRY12 Core 3 Debug 0x00310 0x00310003°P 
ROMENTRY13 Core 3 CTI 0x00320 0x00320003°P 
ROMENTRY14 Core 3 PMU 0x00330 0x00330003°P 
ROMENTRY15 Core 3 ETM 0x00340 0x00340003°P 














ROM table Debug Peripheral Identification Registers 


The ROM table Debug Peripheral Identification Registers provide standard information required for all 
components that conform to the ARM® Debug Interface Architecture Specification ADIv5.0 to ADIv5.2. 
There is a set of eight registers, listed in register number order in the following table. 


Table 10-33 Summary of the ROM table Debug Peripheral Identification Registers 





Register 


Value Offset 





ROMPID4 


0x04 @©xFDO 





ROMPID5 


0x00 OxFD4 





ROMPID6 


0x00 OxFD8 





ROMPID7 


0x00 OxFDC 





ROMPIDO 


@xA4 OxFE@ 





ROMPID1 


@xB4 OxFE4 





ROMPID2 


@x®B OxFE8 








ROMPID3 


0x00 OxFEC 





Only bits[7:0] of each ROM table Debug Peripheral ID Register are used, with bits[3 1:8] reserved. 
Together, the eight ROM table Debug Peripheral ID Registers define a single 64-bit Peripheral ID. 


The ROM table Debug Peripheral ID registers are: 
e ROM table Debug Peripheral Identification Register 0 on page 10-387. 
e ROM table Debug Peripheral Identification Register 1 on page 10-388. 
e ROM table Debug Peripheral Identification Register 2 on page 10-389. 
e ROM table Debug Peripheral Identification Register 3 on page 10-390. 
e ROM table Debug Peripheral Identification Register 4 on page 10-390. 
e ROM table Debug Peripheral Identification Register 5-7 on page 10-391. 


ROM table Debug Peripheral Identification Register 0 


The ROMPIDRO characteristics are: 


Purpose 


Provides information to identify an external debug component. 
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10 Debug 
10.11 ROM table 
Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The ROMPIDR0O is in the Debug power domain. 
Attributes 


See the register summary in Table 10-30 ROM table registers on page 10-384. 
The following figure shows the ROMPIDRO bit assignments. 


31 8 7 0 


Figure 10-25 ROMPIDRO bit assignments 
The following table shows the ROMPIDRO bit assignments. 


Table 10-34 ROMPIDRO bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:0] Part 0 exaa Least significant byte of the ROM table part number. 





ROM table Debug Peripheral Identification Register 1 


The ROMPIDRI characteristics are: 


Purpose 
Provides information to identify an external debug component. 
Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





soa â S S “% ko 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The ROMPIDR!1 is in the Debug power domain. 
Attributes 


See the register summary in Table 10-30 ROM table registers on page 10-384. 
The following figure shows the ROMPIDR!1 bit assignments. 
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31 8 7 4 3 0 


Figure 10-26 ROMPIDR1 bit assignments 
The following table shows the ROMPIDR1 bit assignments. 


Table 10-35 ROMPIDR1 bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] DES_0 exp Least significant nibble of JEP106 ID code. For ARM Limited. 





[3:0] Part_l @x4 Most significant nibble of the ROM table part number. 





ROM table Debug Peripheral Identification Register 2 
The ROMPIDR2 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 


Off DLK OSLK EDAD SLK Default 





-~ os & i, & RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The ROMPIDR2 is in the Debug power domain. 


Attributes 
See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMPIDR2 bit assignments. 


31 8 7 432 0 
JEDEC — 


Figure 10-27 ROMPIDR2 bit assignments 
The following table shows the ROMPIDR2 bit assignments. 
Table 10-36 ROMPIDR2 bit assignments 





Bits Name Function 














[31:8] - Reserved, RESO. 
[7:4] Revision øxø Part major revision. 
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Table 10-36 ROMPIDR2 bit assignments (continued) 





Bits Name Function 





[3] JEDEC @b1 RAO. Indicates a JEP106 identity code is used. 





[2:0] DES_1  @be11 Designer, most significant bits of JEP 106 ID code. For ARM Limited. 





ROM table Debug Peripheral Identification Register 3 


The ROMPIDR3 characteristics are: 


Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





= de Re ob & RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The ROMPIDR3 is in the Debug power domain. 
Attributes 
See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMPIDR3 bit assignments. 


31 8 7 4 3 0 


Figure 10-28 ROMPIDR3 bit assignments 
The following table shows the ROMPIDR3 bit assignments. 


Table 10-37 ROMPIDR3 bit assignments 





Bits Name Function 











[31:8] - Reserved, RESO. 
[7:4] REVAND @x@ Part minor revision. 
[3:0] CMOD exe Customer modified. 





ROM table Debug Peripheral Identification Register 4 
The ROMPIDR4 characteristics are: 


Purpose Provides information to identify an external debug component. 
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Usage constraints Accessible through the internal memory-mapped interface and the external debug 
interface. The access conditions are: 





Off DLK OSLK EDAD SLK Default 





‘ - RO 





Table 11-1 External register access conditions on page 11-398 describes the access 
conditions. 


Configurations The ROMPIDR4 is in the Debug power domain. 
Attributes See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMPIDR4 bit assignments. 
31 8 7 4:3 0 


Figure 10-29 ROMPIDR4 bit assignments 
The following table shows the ROMPIDR4 bit assignments. 


Table 10-38 ROMPIDR4 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] Size @x@ Size of the component. Log2 the number of 4KB pages from the start of the component to the end of the 
component ID registers. 





[3:0] DES_2 øx4 Designer, JEP106 continuation code, least significant nibble. For ARM Limited. 





ROM table Debug Peripheral Identification Register 5-7 


No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. They are 
reserved for future use and are RESO. 


10.11.5 ROM table Debug Component Identification Registers 


There are four read-only Component Identification Registers, Component IDO through Component ID3. 
The following table shows these registers. 


Table 10-39 Summary of the ROM table Debug Component Identification registers 


Register Value Offset 





ROMCIDRO @x@D OxFF@ 





ROMCIDR1 0x10 @xFF4 





ROMCIDR2 0x05 OxFF8 





ROMCIDR3 @xB1 OxFFC 





The ROM table Debug Component Identification Registers identify Debug as an ARM Debug Interface 
v5 component. The ROM table Component ID registers are: 

e ROM table Debug Component Identification Register 0 on page 10-392. 

e+ ROM table Debug Component Identification Register 1 on page 10-392. 
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e ROM table Debug Component Identification Register 2 on page 10-393. 
e ROM table Debug Component Identification Register 3 on page 10-393. 


ROM table Debug Component Identification Register 0 
The ROMCIDRO characteristics are: 


Purpose 
Provides information to identify an external debug component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





. & «2 is a RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The ROMCIDR0O is in the Debug power domain. 
Attributes 
See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMCIDRO bit assignments. 


31 8 7 0 


Figure 10-30 ROMCIDRO bit assignments 
The following table shows the ROMCIDRO bit assignments. 


Table 10-40 ROMCIDRO bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL_0 gxep Preamble byte 0 





ROM table Debug Component Identification Register 1 
The ROMCIDRI characteristics are: 


Purpose Provides information to identify an external debug component. 


Usage constraints Accessible through the internal memory-mapped interface and the external debug 
interface. The access conditions are: 





Off DLK OSLK EDAD SLK Default 





zos & i»  « RO 





Table 11-1 External register access conditions on page 11-398 describes the access 
conditions. 


Configurations The ROMCIDR!1 is in the Debug power domain. 
Attributes See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMCIDRI bit assignments. 
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31 8 7 4 3 0 


Figure 10-31 ROMCIDR1 bit assignments 
The following table shows the ROMCIDR1 bit assignments. 


Table 10-41 ROMCIDR1 bit assignments 


Function 





[31:8] - 


Reserved, RESO. 





[7:4] CLASS 


0x1 Component Class. For a ROM table. 





[3:0] PRMBL_1 xø Preamble. 





ROM table Debug Component Identification Register 2 
The ROMCIDR2 characteristics are: 


Purpose Provides information to identify an external debug component. 


Usage constraints Accessible through the internal memory-mapped interface and the external debug 
interface. The access conditions are: 





Off DLK OSLK EDAD SLK Default 





- RO 





Table 11-1 External register access conditions on page 11-398 describes the access 
conditions. 


Configurations The ROMCIDR2 is in the Debug power domain. 
Attributes See the register summary in Table 10-30 ROM table registers on page 10-384. 


The following figure shows the ROMCIDR2 bit assignments. 
31 8 7 0 


Figure 10-32 ROMCIDR2 bit assignments 
The following table shows the ROMCIDR2 bit assignments. 


Table 10-42 ROMCIDR2 bit assignments 





Bits Name 


Function 














[31:8] - Reserved, RESO 
[7:0] PRMBL 2 9x@5 Preamble byte 2 
ROM table Debug Component Identification Register 3 
The ROMCIDR3 characteristics are: 
Purpose 
Provides information to identify an external debug component. 
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Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





: - RO 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The ROMCIDR3 is in the Debug power domain. 
Attributes 


See the register summary in Table 10-30 ROM table registers on page 10-384. 
The following figure shows the ROMCIDR3 bit assignments. 


31 8 7 0 


Figure 10-33 ROMCIDR3 bit assignments 
The following table shows the ROMCIDR3 bit assignments. 


Table 10-43 ROMCIDR3 bit assignments 

















Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL 3 øxB1 Preamble byte 3 
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Chapter 11 
Performance Monitor Unit 


This section describes the Performance Monitor Unit (PMU) and the registers that it uses. 


It contains the following sections: 

e 11.1 About the PMU on page 11-396. 

¢ 11.2 PMU functional description on page 11-397. 

e 11.3 AArch64 PMU register summary on page 11-399. 

e 11.4 AArch64 PMU register descriptions on page 11-401. 
e 11.5 AArch32 PMU register summary on page 11-406. 

¢ 11.6 Memory-mapped register summary on page 11-408. 
e 11.7 Memory-mapped register descriptions on page 11-411. 
e 11.8 Events on page 11-428. 

e 11.9 Interrupts on page 11-432. 

¢ 11.10 Exporting PMU events on page 11-433. 





ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. 11-395 
Non-Confidential 


11 Performance Monitor Unit 
11.1 About the PMU 


11.1 About the PMU 


The processor includes logic to gather various statistics on the operation of the processor and memory 
system during runtime, based on PMUV3 architecture. 


These events provide useful information about the behavior of the processor that you can use when 
debugging or profiling code. 


The processor PMU provides six counters. Each counter can count any of the events available in the 
processor. The absolute counts recorded might vary because of pipeline effects. This has negligible effect 
except in cases where the counters are enabled for a very short time. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 11-396 
Non-Confidential 


11 Performance Monitor Unit 
11.2 PMU functional description 


11.2 PMU functional description 
Describes the functionality of the PMU. 
The following figure shows the PMU block diagram. 
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Figure 11-1 PMU block diagram 


This section contains the following subsections: 


e 11.2.1 Event interface on page 11-397. 

e 11.2.2 System register and APB interface on page 11-397. 

e 11.2.3 Counters on page 11-397. 

e 11.2.4 PMU register interfaces on page 11-398. 

e 11.2.5 External register access permissions on page 11-398. 


11.2.1 Event interface 


Events from all other units from across the design are provided to the PMU. 


11.2.2 System register and APB interface 


You can program the PMU registers using the System registers or the external APB interface. 


11.2.3 Counters 


The Cortex-A72 processor has six counters. Each counter can count any of the events available in the 
processor. 
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11.2.5 


PMU register interfaces 


11 Performance Monitor Unit 
11.2 PMU functional description 


The Cortex-A72 processor supports access to the Performance Monitor registers from the System 
registers and a memory-mapped interface. External access to the Performance Monitor registers is also 
provided with the APB slave interface. 


Related information 


10.10 External debug interface on page 10-381. 


External register access permissions 


External access permission to the PMU registers is subject to the conditions at the time of the access. The 
following table describes the processor response to accesses through the external debug and memory- 


mapped interfaces. 


Table 11-1 External register access conditions 





Condition Condition trigger 


Description 























Off EDPRSR.PU is 0 Core power domain is completely off, or in a low-power state where the 

Core power domain registers cannot be accessed. 
Note 

If debug power is off then all external debug and memory-mapped register 
accesses return an error. 

DLK EDPRSR.DLK is 1 OS Double Lock is locked. 

OSLK OSLSR_EL1.OSLK is 1 OS Lock is locked. 

EPMAD AllowExternalPMUAccess() == External performance monitors access disabled. When an error is returned 

FALSE because of the EPMAD condition, and this is the highest priority error 

condition, EDPRSR.SPMAD is set to 1. Otherwise SPMAD is unchanged. 

SLK Memory-mapped interface only Software Lock is locked. For the external debug interface, ignore this 
condition. 

Default - None of the conditions apply, normal access. 





The following table shows an example of external register access conditions for access to a Performance 
Monitors register. To determine the access permission for the register, scan the columns from left to 
right. Stop at the first column whose condition is true, the entry gives the register’s access permission 


and scanning stops. 


Table 11-2 External register access conditions example 





Off DLK OSLK EPMAD SLK Default 





- - - - RO/WI RO 
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11.3 AArch64 PMU register summary 


11.3 AArch64 PMU register summary 


The PMU counters and their associated control registers are accessible in AArch64 state with MRS and 
MSR instructions. 


The following table shows the PMU registers in AArch64 state. It also shows the offset address for the 
registers that are accessible from the internal memory-mapped interface or the external debug interface. 


Table 11-3 PMU register summary in AArch64 state 





Offset Name Type Width Description 





MCR_ELO RW 32-bit 11.4.1 Performance Monitors Control Register, ELO on page 11-401 





MCNTENSET ELO RW 32-bit Performance Monitors Count Enable Set Register 





MCNTENCLR_ELO RW 32-bit Performance Monitors Count Enable Clear Register “4 





MOVSCLR_ELO RW 32-bit Performance Monitors Overflow Flag Status Register “4 





MSWINC_ELO WO 32-bit Performance Monitors Software Increment Register “4 








MSELR_ELO RW 32-bit Performance Monitors Event Counter Selection Register “4 





© 
x< 
ie) 
o0 
© 
UT) UU) Ul) W| Ds] WI 


MCEIDO_ELO RO 32-bit 11.4.2 Performance Monitors Common Event Identification Register 0, ELO 
on page 11-403 





MCEID1_ELO RO 32-bit Performance Monitors Common Event ID Register 1 °4 





MCCNTR_ELO RW 64-bit Performance Monitors Cycle Count Register “4 





MXEVTYPER ELO RW 32-bit Performance Monitors Selected Event Type Register “4 





MCCFILTR_ELO RW 32-bit Performance Monitors Cycle Count Filter Register °4 ©" 





MXEVCNTRO_ELO RW 32-bit Performance Monitors Selected Event Count Register “4 





MUSERENR ELO RW 32-bit Performance Monitors User Enable Register “4 





MINTENSET ELI RW 32-bit Performance Monitors Interrupt Enable Set Register “4 








MOVSSET_ELO RW 32-bit Performance Monitors Overflow Flag Status Set Register “4 








MEVCNTRO_ELO RW 32-bit Performance Monitors Event Count Registers “4 





MEVCNTRI ELO 





MEVCNTR2_ELO 





MEVCNTR3_ELO 





MEVCNTR4 ELO 








P 
P 
P 
P 
P 
P 
P 
@xC6@ PMINTENCLR ELI RW 32-bit Performance Monitors Interrupt Enable Clear Register “4 
P 
P 
P 
P 
P 
P 
P 








MEVCNTRS_ELO 








eq See the ARM” Architecture Reference Manual ARMV8 for more information. 
cr The CP15 encoding provides access to PMCCFILTR_ELO only when PMSELR_EL0.SEL==31. 
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11.3 AArch64 PMU register summary 


Table 11-3 PMU register summary in AArch64 state (continued) 



































Offset Name Type Width Description 

0x400 PMEVTYPERO ELO RW 32-bit Performance Monitors Event Type Registers “4 

0x404 PMEVTYPERI ELO 

0x408 PMEVTYPER2_EL0 

@x40C PMEVTYPER3 ELO 

0x410 PMEVTYPER4 ELO 

0x414 PMEVTYPERS ELO 

@x47C PMCCFILTR_ELO RW 32-bit Performance Monitors Cycle Count Filter Register “4 
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11.4 AArch64 PMU register descriptions 
This section describes the Cortex-A72 processor PMU registers in AArch64 state. 


Table 11-3 PMU register summary in AArch64 state on page 11-399 provides cross-references to 
individual registers. 


This section contains the following subsections: 

¢ 11.4.1 Performance Monitors Control Register, ELO on page 11-401. 

e 11.4.2 Performance Monitors Common Event Identification Register 0, ELO on page 11-403. 
11.4.1 Performance Monitors Control Register, ELO 


The PMCR_ELO characteristics are: 


Purpose Provides information on the Performance Monitors implementation, including the 
number of counters implemented, and configures and controls the counters. 

Usage The accessibility of the PMCR_ELO by Exception level is: 

constraints 


ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





Config RW RW RW RW RW 





The external accessibility to the PMCR_ELO by condition code is: 


Off DLK OSLK EPMAD SLK Default 





Error Error Error Error RO/WI RW 





Table 11-1 External register access conditions on page 11-398 describes the access 
conditions. 


Configurations The PMCR_ELO is Common to Secure and Non-secure states and architecturally 
mapped to: 
e The AArch32 PMCR register. 
e The external PMCR_ELO register. 


Attributes See the register summary in Table 11-3 PMU register summary in AArch64 state 
on page 11-399. 


The following figure shows the PMCR_ELO bit assignments for a System register access. 


24 23 16 15 11 10 76543 2 1 0 





Figure 11-2 PMCR_ELO bit assignments 


The following table shows the PMCR_ELO bit assignments for a System register access. 
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11.4 AArch64 PMU register descriptions 


Table 11-4 PMCR_ELO bit assignments 





Bits Name Function 





[31:24] IMP Implementer code: 
0x41 ARM. 


This is a read-only field. 





[23:16] IDCODE Identification code: 


0x02 Cortex-A72 processor. 


This is a read-only field. 





[15:11] N Number of event counters. 


In Non-secure modes other than Hyp mode, this field reads the value of HDCR.HPMN. See 4.5.12 Hyp Debug 
Control Register on page 4-261. 


In Secure state and Hyp mode, this field returns @x6 that indicates the number of counters implemented. 


This is a read-only field. 





[10:7] - Reserved, RESO. 





[6] LC Long cycle count enable. Selects which PMCCNTR_ELO bit generates an overflow recorded in PMOVSR[31]: 


0 Overflow on increment that changes PMCCNTR_ELO[31] from 1 to 0. 
1 Overflow on increment that changes PMCCNTR_ELO[63] from 1 to 0. 





[5] DP Disable cycle counter, PMCCNTR_ELO when event counting is prohibited: 


0 Cycle counter operates regardless of the non-invasive debug authentication settings. 


1 Cycle counter is disabled if non-invasive debug is not permitted and enabled. 


This bit is read/write. 





[4] x Export enable. This bit permits events to be exported to another debug device, such as a trace macrocell, over an 
event bus: 


0 Export of events is disabled. 


1 Export of events is enabled. 


This bit is read/write and does not affect the generation of Performance Monitors interrupts, that can be 
implemented as a signal exported from the processor to an interrupt controller. 





[3] D Clock divider: 


0 When enabled, PMCCNTR_ELO counts every clock cycle. 
1 When enabled, PMCCNTR_ELO counts every 64 clock cycles. 


This bit is read/write. 
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Table 11-4 PMCR_ELO bit assignments (continued) 





Bits Name Function 





[2] Ç Clock counter reset: 
0 No action. 
1 Reset PMCCNTR_ELO to 0. 
Note 





Resetting PMCCNTR does not clear the PMCCNTR_ELO overflow bit to 0. See the ARM” Architecture Reference 
Manual ARMV8 for more information. 





This bit is write-only, and always RAZ. 





[1] P Event counter reset: 
0 Noaction. 


1 Reset all event counters, not including PMCCNTR_ELO, to 0. 


In Non-secure modes other than Hyp mode, a write of 1 to this bit does not reset event counters that the 
HDCR.HPMN field reserves for Hyp mode use. See 4.5.12 Hyp Debug Control Register on page 4-261. 


In Secure state and Hyp mode, a write of 1 to this bit resets all the event counters. 





[0] E Enable bit. This bit does not disable or enable, counting by event counters reserved for Hyp mode by 
HDCR.HPMN. It also does not suppress the generation of performance monitor overflow interrupt requests by 
those counters: 


0 All counters, including PMCCNTR_ELO, are disabled. This is the reset value. 


1 All counters are enabled. 


This bit is read/write. 





To access the PMCR_ELO in AArch64 state, read or write the register with: 


MRS <Xt>, PMCR_EL@; Read Performance Monitors Control Register 
MSR PMCR_EL@, <Xt>; Write Performance Monitors Control Register 


To access the PMCR in AArch32 state, read or write the CP15 registers with: 


MRC p15, @, <Rt>, c9, c12, @; Read Performance Monitors Control Register 
MCR p15, ©, <Rt>, c9, c12, 0; Write Performance Monitors Control Register 


See 71.7.1 Performance Monitors Control Register, ELO on page 11-411 for information about accessing 
the PMCR_ELO through the internal memory-mapped interface and the external debug interface. 


11.4.2 Performance Monitors Common Event Identification Register 0, ELO 


The PMCEIDO_ELO characteristics are: 


Purpose 
Defines which common architectural and common micro-architectural feature events are 
implemented. 
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Usage constraints 
The accessibility to the PMCEIDO_ELO by Exception level is: 





ELO (NS) ELO (S) EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





Config Config RO RO RO RO RO 





The external accessibility to the PMCEID0_ELO by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error Error Error RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMCEIDO_ELO is Common to Secure and Non-secure states and architecturally mapped to: 
e The AArch32 PMCEID0 register. 
¢ The external PMCEIDO_ ELO register. 


Attributes 
See the register summary in Table 11-3 PMU register summary in AArch64 state 
on page 11-399. 


The following figure shows the PMCEID0_ELO bit assignments 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 76543 210 








reso | Tw ME- ie: | Love 
CH Bcz- | hee | Lon R 
DC2R DC1R 
DC2A ics DC1A 
DC1W DTiR 


Figure 11-3 PMCEID0_ELO bit assignments 


The following table shows the PMCEIDO_ELO bit assignments with event implemented or not 
implemented when the associated bit is set to 1 or 0. 


PMCEID1_ELO0[31:0] is reserved. 


Table 11-5 Common Event Identification Register 0 bit assignments 





Bit Name Event number Value Event implemented if bit set to 1 or not implemented if bit set to 0 


























[81] - Ox1F 0 Reserved, RESO. 

[30] CH @x1E 1 Chain." An odd-numbered counter increments when an overflow occurs on the preceding 
even-numbered counter. For even-numbered counters, does not count. 

[29] BC @x1D 1 Bus cycle. 

[28] TW @x1C 1 TTBR write, architecturally executed, condition check pass - write to translation table base. 

[27] IS @x1B 1 Instruction speculatively executed. 

[26] ME @x1A 1 Local memory error. 

[25] BA 0x19 1 Bus access. 

[24] DC2W 0x18 1 Level 2 data cache Write-Back. 











eS See the ARM” Architecture Reference Manual ARMV8 for more information about the chain event. 
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Table 11-5 Common Event Identification Register 0 bit assignments (continued) 
















































































Bit Name Event number Value Event implemented if bit set to 1 or not implemented if bit set to 0 

[23] DC2R x17 1 Level 2 data cache refill. 

[22] DC2A x16 1 Level 2 data cache access. 

[21] DCIW 0x15 1 Level 1 data cache Write-Back. 

[20] ICIA 0x14 1 Level 1 instruction cache access. 

[19] MA 0x13 1 Data memory access. 

[18] BP 0x12 1 Predictable branch speculatively executed. 

[17] CC 0x11 1 Cycle. 

[16] BM 0x10 1 Mispredicted or not predicted branch speculatively executed. 

[15] UL OxOF 0 Instruction architecturally executed, condition check pass - unaligned load or store. 
[14] BR Qx@E 0 Instruction architecturally executed, condition check pass - procedure return. 

[13] BI @xe@D 0 Instruction architecturally executed - immediate branch. 

[12] PW @x@C 0 Instruction architecturally executed, condition check pass - software change of the PC. 
[11] CW @xeB 1 Instruction architecturally executed, condition check pass - write to CONTEXTIDR. 
[10] ER @x@A 1 Instruction architecturally executed, condition check pass - exception return. 

[9] ET 0x09 1 Exception taken. 

[8] IA 0x08 1 Instruction architecturally executed. 

[7] ST 0x07 0 Instruction architecturally executed, condition check pass - store. 

[6] LD 0x06 0 Instruction architecturally executed, condition check pass - load. 

[5] DTIR 0x05 1 Level 1 data TLB refill.This event is implemented. 

[4] DCIA 0x04 1 Level 1 data cache access. 

[3] DCIR 0x03 1 Level 1 data cache refill. 

[2] ITIR @x@e2 1 Level 1 instruction TLB refill. 

[1] ICIR @xe@1 1 Level 1 instruction cache refill. 

[0] SI 0x00 1 Instruction architecturally executed, condition check pass - software increment. 








To access the PMCEID0_ELO in AArch64 state, read or write the register with: 


MRS <Xt>, PMCEID@_EL@; Read Performance Monitors Common Event Identification Register @ 


To access the PMCEIDO in AArch32 state, read or write the CP15 register with: 


MRC p15, ©, <Rt>, c9, c12, 6; Read Performance Monitors Common Event Identification Register 


e 


The PMCEIDO_ELO can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xE20. 
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11 Performance Monitor Unit 
11.5 AArch32 PMU register summary 


The PMU counters and their associated control registers are accessible in AArch32 state from the System 
registers with MCR and MRC instructions for 32-bit registers and MCRR and MRRC for 64-bit registers. 


The following table gives a summary of the PMU registers in AArch32 state. 


The table also shows the offset address for the AArch32 registers that are accessible from the internal 
memory-mapped interface or the external debug interface. 


See 71.7 Memory-mapped register descriptions on page 11-411 for a complete list of registers that are 
accessible from the internal memory-mapped interface or the external debug interface. 


Table 11-6 PMU register summary in AArch32 state 
































































































































Offset CRn op1 CRm op2 Name Type Width Description 

@xE@4 c9 0 cl2 0 PMCR RW 32-bit 11.4.1 Performance Monitors Control Register, ELO 
on page 11-401 

@xCee 1 PMCNTENSET RW 32-bit Performance Monitors Count Enable Set Register 

@xC2e 2 PMCNTENCLR RW 32-bit Performance Monitors Count Enable Clear Register °t 

OxC80 3 PMOVSR RW 32-bit Performance Monitors Overflow Flag Status Register “ 

@xCA@ 4 PMSWINC WO 32-bit Performance Monitors Software Increment Register “' 

- 5 PMSELR RW 32-bit Performance Monitors Event Counter Selection Register * 

0xE20 6 PMCEIDO RO 32-bit 11.4.2 Performance Monitors Common Event Identification 
Register 0, ELO on page 11-403 

@xE24 7 PMCEID1 RO 32-bit Performance Monitors Common Event Identification Register 
yet 

Ox@F8 c9 0 cl3 0 PMCCNTR[31:0] RW 32-bit Performance Monitors Cycle Count Register ®t 

@x@FC - - - - PMCCNTR[63:32] 

- - 0 c9 - PMCCNTR[63:0] 64-bit 

- c9 0 cl3 1l PMXEVTYPER RW 32-bit Performance Monitors Selected Event Type Register ®t 

@x47C PMCCFILTR RW 32-bit Performance Monitors Cycle Count Filter Register °t 

- c9 0 cl3 2 PMXEVCNTR RW 32-bit Performance Monitors Selected Event Count Register ®t 

- cl4 0 PMUSERENR RW 32-bit Performance Monitors User Enable Register ° 

OxC40 1 PMINTENSET RW 32-bit Performance Monitors Interrupt Enable Set Register “t 

OxC60 2 PMINTENCLR RW 32-bit Performance Monitors Interrupt Enable Clear Register “ 

OxCCO 3 PMOVSSET RW 32-bit Performance Monitors Overflow Flag Status Set Register “ 

@xee8 cl4 0 c8 0 PMEVCNTRO RW 32-bit Performance Monitors Event Count Registers ®t 

0x008 1 PMEVCNTR1 

0x010 2 PMEVCNTR2 

0x018 3 PMEVCNTR3 

0x020 4 PMEVCNTR4 

0x028 5 PMEVCNTR5 

















et 


See the ARM” Architecture Reference Manual ARMv8 for more information. 
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Table 11-6 PMU register summary in AArch32 state (continued) 





Offset CRn op1 CRm op2 Name 


Type Width Description 






































0x400 cl2 0 PMEVTYPERO RW 32-bit Performance Monitors Event Type Registers “ 
0x404 1 PMEVTYPER1 

0x408 2 PMEVTYPER2 

0x40C 3 PMEVTYPER3 

0x410 4 PMEVTYPER4 

0x414 5 PMEVTYPER5 

@x47C clS 7 PMCCFILTR RW 32-bit Performance Monitors Cycle Count Filter Register “t 
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11.6 Memory-mapped register summary 
The following table shows the PMU registers that are accessible through the internal memory-mapped 
interface and the external debug interface. 
Table 11-7 Memory-mapped PMU register summary 
Offset Name Type Width Description 
0x000 PMEVCNTRO_ELO RW 32-bit Performance Monitors Event Count Register 0 
0x004 - - - Reserved 
0x008 PMEVCNTR1_EL0 RW 32-bit Performance Monitors Event Count Register 1 °" 
@x@@C = - - Reserved 
0x010 PMEVCNTR2_ELO RW 32-bit Performance Monitors Event Count Register 2 °" 
0x014 - - - Reserved 
0x018 PMEVCNTR3_ELO RW 32-bit Performance Monitors Event Count Register 3 °" 
@x@1C - - - Reserved 
0x020 PMEVCNTR4_EL0 RW 32-bit Performance Monitors Event Count Register 4 °" 
0x024 - - - Reserved 
0x028 PMEVCNTRS_ELO RW 32-bit Performance Monitors Event Count Register 5 °" 
@x@2C-OxOF4 - - - Reserved 
OxOF8 PMCCNTR_ELO[31:0] RW 32-bit Performance Monitors Cycle Count Register °" 
@x@FC PMCCNTR_ELO[63:32] RW 32-bit 
@x100-Ox3FC - - Reserved 
0x400 PMEVTYPERO ELO RW 32-bit Performance Monitors Event Type Register °" 
0x404 PMEVTYPER1_EL0 
0x408 PMEVTYPER2_EL0 
0x40C PMEVTYPER3_EL0 
0x410 PMEVTYPER4 ELO 
0x414 PMEVTYPER5_EL0 
0x418-0x478 - - - Reserved 
@x47C PMCCFILTR_ELO RW 32-bit Performance Monitors Cycle Count Filter Register ®" 
@x480-Ox5FC - - - Reserved 
0x600 PMPCSR[31:0] RO 32-bit 11.7.2 Performance Monitors Program Counter Sample Register 
0x604 PMPCSR[63:32] eee 
0x608 PMCIDSR RO 32-bit 11.7.3 Performance Monitors Context ID Sample Register on page 11-412 
@x60C PMVIDSR RO 32-bit 11.7.4 Performance Monitors Virtual Context Sample Register 
on page 11-413 
0x610 PMSSR RO 32-bit 11.7.5 Performance Monitors Snapshot Status Register on page 11-413 








eu See the ARM” Architecture Reference Manual ARMV8 for more information. 
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Table 11-7 Memory-mapped PMU register summary (continued) 




















































































































Offset Name Type Width Description 
0x614 PMOVSSR RO 32-bit 11.7.6 Performance Monitors Overflow Status Snapshot Register 
on page 11-414 
0x618 PMCCNTSR[31:0] RO 32-bit 11.7.7 Performance Monitors Cycle Counter Snapshot Register 
@x61C PMCCNTSR[63:32] RO 32-bit 7 Page 11-415 
0x620 PMEVCNTSRO RO 32-bit 11.7.8 Performance Monitors Event Counters Snapshot Registers 
0x624 PMEVCNTSR1 eee 
0x628 PMEVCNTSR2 
@x62C PMEVCNTSR3 
0x630 PMEVCNTSR4 
0x634 PMEVCNTSR5 
@x638-Ox6EC - - - Reserved 
Ox6FO PMSCR WO 32-bit 11.7.9 Performance Monitors Snapshot Control Register on page 11-416 
Ox6F4 PMSRR RW 32-bit 11.7.10 Performance Monitors Snapshot Reset Register on page 11-417 
Ox6F8-OxBFC - - - Reserved 
exCee PMCNTENSET_ELO RW 32-bit Performance Monitors Count Enable Set Register °" 
@xC@4-OxC1C - - - Reserved 
@xC20 PMCNTENCLR ELO RW 32-bit Performance Monitors Count Enable Clear Register ®" 
@xC24-OxC3C - - - Reserved 
@xC4e PMINTENSET _ EL1 RW 32-bit Performance Monitors Interrupt Enable Set Register ©" 
@xC44-OxC5C - - - Reserved 
OxC60 PMINTENCLR ELI RW 32-bit Performance Monitors Interrupt Enable Clear Register ®" 
@xC64-OxC7C - - - Reserved 
@xC8e PMOVSCLR_ELO RW 32-bit Performance Monitors Overflow Flag Status Register °" 
@xC84-OxC9C - - - Reserved 
@xCAd PMSWINC_ELO WO 32-bit Performance Monitors Software Increment Register °" 
@xCA4-OxCBC - - - Reserved 
OxCCO PMOVSSET_ELO RW 32-bit Performance Monitors Overflow Flag Status Set Register ©" 
@xCC4-OxDFC - - - Reserved 
OxE0O PMCFGR RO 32-bit 11.7.11 Performance Monitors Configuration Register on page 11-418 
OxE04 PMCR_ELO RW 32-bit 11.7.1 Performance Monitors Control Register, ELO on page 11-411 
@xEQ@8-OxE1C - - - Reserved 
@xE20 PMCEIDO_ELO RO 32-bit 11.4.2 Performance Monitors Common Event Identification Register 0, ELO 
on page 11-403 
@xE24 PMCEID1_ ELO RO 32-bit Performance Monitors Common Event Identification Register 1 °" 





QxE28-OxFA4 


Reserved 
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Table 11-7 Memory-mapped PMU register summary (continued) 













































































Offset Name Type Width Description 
OxFA8 PMDEVAFFO0 RO 32-bit Performance Monitors Device Affinity Register 0, see 4.3.2 Multiprocessor 
Affinity Register, EL1 on page 4-90 

@xFAC PMDEVAFF1 RO 32-bit Performance Monitors Device Affinity Register 1, RESO. 

OxFB@ PMLAR WO 32-bit Performance Monitors Lock Access Register °" 

OxFB4 PMLSR RO 32-bit Performance Monitors Lock Status Register °" 

OxFB8 PMAUTHSTATUS RO 32-bit Performance Monitors Authentication Status Register ®" 

@xFBC PMDEVARCH 32-bit Performance Monitors Device Architecture Register °" 

@xFCO-OxFC8 - - - Reserved 

@xFCC PMDEVTYPE RO 32-bit Performance Monitors Device Type Register ©" 

@xFDO PMPIDR4 RO 32-bit Performance Monitors Peripheral Identification Register 4 on page 11-423 

@xFD4 PMPIDRS RO 32-bit Performance Monitors Peripheral Identification Register 5-7 

@xFD8 PMPIDR6 een 

@xFDC PMPIDR7 

OxFEO PMPIDRO RO 32-bit Performance Monitors Peripheral Identification Register 0 on page 11-420 

@xFE4 PMPIDR1 RO 32-bit Performance Monitors Peripheral Identification Register 1 on page 11-420 

OxFE8 PMPIDR2 RO 32-bit Performance Monitors Peripheral Identification Register 2 on page 11-421 

@xFEC PMPIDR3 RO 32-bit Performance Monitors Peripheral Identification Register 3 on page 11-422 

OxFFO PMCIDRO RO 32-bit Performance Monitors Component Identification Register 0 on page 11-424 

OxFF4 PMCIDR1 RO 32-bit Performance Monitors Component Identification Register 1 on page 11-425 

OxFF8 PMCIDR2 RO 32-bit Performance Monitors Component Identification Register 2 on page 11-426 

OxFFC PMCIDR3 RO 32-bit Performance Monitors Component Identification Register 3 on page 11-426 
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11.7 Memory-mapped register descriptions 


This section describes the Cortex-A72 processor PMU registers accessible through the memory-mapped 
and debug interfaces. 


11.6 Memory-mapped register summary on page 11-408 provides cross-references to individual registers. 


This section contains the following subsections: 

e 11.7.1 Performance Monitors Control Register, ELO on page 11-411. 

e 11.7.2 Performance Monitors Program Counter Sample Register on page 11-412. 

e 11.7.3 Performance Monitors Context ID Sample Register on page 11-412. 

¢ 11.7.4 Performance Monitors Virtual Context Sample Register on page 11-413. 

e 11.7.5 Performance Monitors Snapshot Status Register on page 11-413. 

e 11.7.6 Performance Monitors Overflow Status Snapshot Register on page 11-414. 

e 11.7.7 Performance Monitors Cycle Counter Snapshot Register on page 11-415. 

e 11.7.8 Performance Monitors Event Counters Snapshot Registers on page 11-415. 
e 11.7.9 Performance Monitors Snapshot Control Register on page 11-416. 

e 11.7.10 Performance Monitors Snapshot Reset Register on page 11-417. 

e 11.7.11 Performance Monitors Configuration Register on page 11-418. 

e 11.7.12 Performance Monitors Peripheral Identification Registers on page 11-419. 
e 11.7.13 Performance Monitors Component Identification Registers on page 11-424. 


11.7.1 Performance Monitors Control Register, ELO 


The PMCR_ELO characteristics are: 


Purpose 
Configures and controls the counters. 
Usage constraints 
The external accessibility to the PMCR_ELO by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error Error Error RO/WI RW 





Table 11-1 External register access conditions on page 11-398 describes the access conditions. 


Configurations 
The PMCR_ELO is Common to Secure and Non-secure states and architecturally mapped to: 
e The AArch32 PMCR register. 
e The external PMCR_ELO register. 


Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMCR_ELO bit assignments for a memory-mapped access. 
31 76543210 
Figure 11-4 PMCR_ELO bit assignments, memory-mapped view 
The following table shows the PMCR_ELO bit assignments for a memory-mapped access. 
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Table 11-8 PMCR_ELO bit assignments, memory-mapped view 





Bits Name Function 


























[31:7] - Reserved, RESO. 
[6] LC The function of these bits is the same as when a System register access occurs. See Table 11-4 PMCR_ELO bit 
5 DP assignments on page 11-402 for a description of these bits. 
[4] x 
B] D 
R] c 
fl] P 
[0] E 
The PMCR_ELO can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xE@4. 
11.7.2 Performance Monitors Program Counter Sample Register 
The PMPCSR characteristics are: 
Purpose 
The PMPCSR registers are aliases of the EDPCSR debug registers. Reads of the PMPCSR 
registers return a copy of the EDPCSR debug registers but does not: 
e Cause anew EDPCSR capture. 
e Change the EDCIDSR and EDVIDSR registers. 
Usage constraints 
The external accessibility to the PMPCSR by condition code is: 
Off DLK OSLK EPMAD SLK Default 
Error Error RO RO RO RO 
Table 11-1 External register access conditions on page 11-398 describes the condition codes. 
Configurations 
PMPCSRJ31:0] copies the EDPCSRlo debug register. 
PMPCSR[63:32] copies the EDPCSRhi debug register. 
Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 
See the ARM® Architecture Reference Manual ARMV8 for more information about the EDPCSR debug 
registers. 
PMPCSR[31:0] can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x600. 
PMPCSR[63:32] can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x604. 
11.7.3 Performance Monitors Context ID Sample Register 
The PMCIDSR characteristics are: 
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Purpose 
The PMCIDSR register is an alias of the EDCIDSR debug register. Reads of the PMCIDSR 
return a copy of the EDCIDSR debug register. 

Usage constraints 
The external accessibility to the PMCIDSR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RO RO RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
There is no configuration information for PMCIDSR. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


See the ARM® Architecture Reference Manual ARMV8 for more information about the EDCIDSR debug 
register. 


PMCIDSR can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x608. 


11.7.4 Performance Monitors Virtual Context Sample Register 


The PMVIDSR characteristics are: 


Purpose 
The PMVIDSR register is an alias of the EDVIDSR debug register. Reads of the PMVIDSR 
return a copy of the EDVIDSR debug register. 

Usage constraints 
The external accessibility to the PMVIDSR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RO RO RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
There is no configuration information for PMVIDSR. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


See the ARM® Architecture Reference Manual ARMV8 for more information about the EDVIDSR debug 
register. 


PMVIDSR can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x6@C. 


11.7.5 Performance Monitors Snapshot Status Register 


The PMSSR characteristics are: 


Purpose 
Provides status information on whether the PMU counters have been captured. 
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Usage constraints 
The external accessibility to the PMSSR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RO RO RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 
A security violation prevents the capture of the event counters. 


The external monitor must keep track of whether the snapshot registers were captured by the 
processor. 


To prevent loss of data, software must save and restore the PMU state, including the PMSCR 
and PMSRR registers, when capturing over a reset or power down. 


Configurations 
There is no configuration information for PMSSR. 

Attributes 
See the register summary in Zable 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMSSR bit assignments. 


31 1 0 
met O 
NC al 


Figure 11-5 PMSSR bit assignments 
The following table shows the PMSSR bit assignments. 


Table 11-9 PMSSR bit assignments 





Bits Name Function 





[31:1] - Reserved, RESO. 





[0] NC No capture. The possible values are: 


0 PMU counters captured. 
1 PMU counters not captured. 
The NC bit: 


e Is reset to 1 by a Warm reset but overwritten at the first capture. 
* Does not reflect the status of the captured Program Counter Sample registers. 





PMSSR can be accessed through the internal memory-mapped interface and the external debug interface, 
offset 0x610. 


11.7.6 Performance Monitors Overflow Status Snapshot Register 


The PMOVSSR characteristics are: 


Purpose 
Captures a copy of the PMOVSR register. After capture, writes to PMOVSSET_ELO and 
PMOVSCLR_ELO do not affect the PMOVSSR value. 
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Usage constraints 
The external accessibility to the PMOVSSR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RO RO RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
There is no configuration information for PMOVSSR. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


See the ARM® Architecture Reference Manual ARMV8 for more information about the PMOVSR register. 
PMOVSSR can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x614. 


11.7.7 Performance Monitors Cycle Counter Snapshot Register 


The PMCCNTSR characteristics are: 


Purpose 
Captures a copy of the PMCCNTR_ELO register. After capture, writes to PMCCNTR_ELO and 
PMCR_ELO.C do not affect the PMCCNTSR value. 

Usage constraints 
The external accessibility to the PMCCNTSR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RO RO RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
There is no configuration information for PMCCNTSR. 
Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 
See the ARM® Architecture Reference Manual ARMV8 for more information about the PMCCNTR_ELO 
register. 


PMCCNTSR[31:0] can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x618. 


PMCCNTSR[63:32] can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x61C. 


11.7.8 Performance Monitors Event Counters Snapshot Registers 


The PMEVCNTSRn characteristics are: 
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Purpose 
Captures a copies of the PMEVCNTRn_EL0 registers. After capture, writes to 
PMEVCNTRn_ELO and PMCR_ELO.P do not affect the PMEVCNTSRn value. 


Note 
The range of n for PMEVCNTSRn is 0 to 5. 








Usage constraints 
The external accessibility to the PMEVCNTSRn by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RO RO RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
There is no configuration information for PMEVCNTSRn. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


See the ARM” Architecture Reference Manual ARMV8 for more information about the 
PMEVCNTRn_ELO registers. 


The PMEVCNTRn_ELO registers can be accessed through the internal memory-mapped interface and 
the external debug interface, offsets 0x620-0x634. 


11.7.9 Performance Monitors Snapshot Control Register 


The PMSCR characteristics are: 


Purpose 
Initiates an immediate capture. 
Usage constraints 
The external accessibility to the PMSCR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error WO WO WO WO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
There is no configuration information for PMSCR. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMSCR bit assignments. 


31 1 0 
net O 
SS a 


Figure 11-6 PMSCR bit assignments 
The following table shows the PMSCR bit assignments. 
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Table 11-10 PMSCR bit assignments 





Bits Name Function 





[31:1] - Reserved, RESO. 





[0] SS Capture now. The possible values are: 


0 Capture ignored. 


1 Initiate a capture immediately. 





The PMSCR can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x6FO. 


11.7.10 Performance Monitors Snapshot Reset Register 


The PMSRR characteristics are: 


Purpose Reset the cycle counter and the performance counters. 
Usage constraints The external accessibility to the PMSRR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error RW RW RW RW 





Table 11-1 External register access conditions on page 11-398 describes the 
condition codes. 


Configurations There is no configuration information for PMSRR. 


Attributes See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMSRR bit assignments. 


31 30 6543210 
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Figure 11-7 PMSRR bit assignments 
The following table shows the PMSRR bit assignments. 


Table 11-11 PMSRR bit assignments 





Bits Name Function 





[31] RC Reset cycle counter. Indicates whether the PMCCNTR_ELO and PMOVSR{J3 1] are reset after a capture: 


0 PMCCNTR_ELO and PMOVSR{31] are not reset on capture. 
1 =PMCCNTR_ELO and PMOVSR{31] are reset on capture. 





[30:6] - Reserved, RESO. 
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Table 11-11 PMSRR bit assignments (continued) 





Bits 


Name Function 





RPS 


Reset performance counter 5. Indicates whether PMEVCNTRS_ELO and PMOVSRJ5] are reset after a capture: 


0 PMEVCNTRS_ELO and PMOVSR[5] are not reset on capture. 
1  PMEVCNTRS ELO and PMOVSRJ5] are reset on capture. 





Reset performance counter 4. Indicates whether PMEVCNTR4 ELO and PMOVSR{4] are reset after a capture: 


0 PMEVCNTR4 ELO and PMOVSR[4] are not reset on capture. 
1 PMEVCNTR4 ELO and PMOVSR{4] are reset on capture. 





[3] 


Reset performance counter 3. Indicates whether PMEVCNTR3_ELO and PMOVSR{3] are reset after a capture: 


0 PMEVCNTR3_ELO and PMOVSR{3] are not reset on capture. 
1 PMEVCNTR3_ ELO and PMOVSR{3] are reset on capture. 





[2] 


Reset performance counter 2. Indicates whether PMEVCNTR2_EL0 and PMOVSR[2] are reset after a capture: 


0 PMEVCNTR2_ELO and PMOVSR[2] are not reset on capture. 
1 PMEVCNTR2_ ELO and PMOVSR[2] are reset on capture. 





[1] 


Reset performance counter 1. Indicates whether PMEVCNTRI1_ELO and PMOVSR{[1] are reset after a capture: 


0 PMEVCNTRI ELO and PMOVSR[1] are not reset on capture. 
1 PMEVCNTR1 ELO and PMOVSR{[1] are reset on capture. 





Reset performance counter 0. Indicates whether PMEVCNTRO_ELO and PMOVSR)[0] are reset after a capture: 


0 PMEVCNTRO ELO and PMOVSR[O0] are not reset on capture. 
1  PMEVCNTRO_ELO and PMOVSR[0] are reset on capture. 





11.7.11 


The PMSRR can be accessed through the internal memory-mapped interface and the external debug 


interface, offset @x6F4. 


Performance Monitors Configuration Register 


The PMCFGR characteristics are: 


Purpose 
Contains PMU specific configuration data. 
Usage constraints 
The accessibility to the PMCFGR by condition code is: 





Off DLK OSLK EPMAD SLK Default 





Error Error Error Error RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMCFGR is in the Core power domain. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMCFGR bit assignments. 
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The following table shows the PMCFGR bit assignments. 
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CCD 


Figure 11-8 PMCFGR bit assignments 


Table 11-12 PMCFGR bit assignments 























Bits Name Function 
[31:17] - Reserved, RESO. 
[16] EX Export supported. The value is: 
1 Export is supported. PMCR_ELO0.EX is read/write. 
[15] CCD Cycle counter has pre-scale. The value is: 
1 PMCR_ELO.D is read/write. 
[14] CC Dedicated cycle counter supported. The value is: 
1 Dedicated cycle counter is supported. 
[13:8] Size Counter size. The value is: 
0b111111 64-bit counters. 
[7:0] N Number of event counters. The value is: 
0x06 Six counters. 
The PMCFGR can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0xE0O. 
11.7.12 Performance Monitors Peripheral Identification Registers 


The Performance Monitors Peripheral Identification Registers provide standard information required for 
all components that conform to the ARM PMUv3 architecture. There is a set of eight registers, listed in 


register number order in the following table. 


Table 11-13 Summary of the Performance Monitors Peripheral Identification Registers 





Register Value Offset 





0x04 


OxFDO 





0x00 


@xFD4 





0x00 


OxFD8 





0x00 


@xFDC 





@xD8 


OxFE@ 





@xB9 


OxFE4 





8x@B 


OxFE8 








0x00 


OxFEC 
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Only bits[7:0] of each PMU Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
PMU Peripheral ID Registers define a single 64-bit Peripheral ID. 


The PMU Peripheral ID registers are: 

e Performance Monitors Peripheral Identification Register 0 on page 11-420. 

e Performance Monitors Peripheral Identification Register 1 on page 11-420. 

e Performance Monitors Peripheral Identification Register 2 on page 11-421. 

e Performance Monitors Peripheral Identification Register 3 on page 11-422. 

e Performance Monitors Peripheral Identification Register 4 on page 11-423. 

e Performance Monitors Peripheral Identification Register 5-7 on page 11-424. 


Performance Monitors Peripheral Identification Register 0 


The PMPIDRO characteristics are: 


Purpose 
Provides information to identify a Performance Monitors component. 

Usage constraints 
The PMPIDRO can be accessed through the internal memory-mapped interface and the external 
debug interface. 


The accessibility to the PMPIDRO by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMPIDRO is in the Debug power domain. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMPIDRO bit assignments. 


31 8 7 0 


Figure 11-9 PMPIDRO bit assignments 
The following table shows the PMPIDRO bit assignments. 


Table 11-14 PMPIDRO bit assignments 





Bits Name Function 


[31:8] - Reserved, RESO 





[7:0] Part0 @xpg Least significant byte of the performance monitor part number 





The PMPIDRO can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFEO. 


Performance Monitors Peripheral Identification Register 1 


The PMPIDR1 characteristics are: 
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Purpose 
Provides information to identify a Performance Monitors component. 

Usage constraints 
The PMPIDRI can be accessed through the internal memory-mapped interface and the external 
debug interface. 


The accessibility to the PMPIDR1 by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMPIDR1 is in the Debug power domain. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMPIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 11-10 PMPIDR1 bit assignments 
The following table shows the PMPIDR1 bit assignments. 


Table 11-15 PMPIDR1 bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] DES_0 exp ARM Limited. This is the least significant nibble of JEP106 ID code. 





[3:0] Part_l x9 Most significant nibble of the performance monitor part number. 





The PMPIDRI can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFE4. 

Performance Monitors Peripheral Identification Register 2 

The PMPIDR2 characteristics are: 


Purpose 

Provides information to identify a Performance Monitors component. 
Usage constraints 

The accessibility to the PMPIDR2 by condition code is: 


Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


The PMPIDR2 can be accessed through the internal memory-mapped interface and the external 
debug interface. 
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Configurations 
The PMPIDR2 is in the Debug power domain. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMPIDR2 bit assignments. 


31 8.7 432 0 
JEDEC — 


Figure 11-11 PMPIDR2 bit assignments 
The following table shows the PMPIDR2 bit assignments. 


Table 11-16 PMPIDR2 bit assignments 





Bits Name Function 











[31:8] - Reserved, RESO. 
[7:4] Revision øxø Part major revision. 
[3] JEDEC @b1 RAO. Indicates a JEP 106 identity code is used. 





[2:0] DES 1  @pe11 ARM Limited. This is the most significant nibble of JEP106 ID code. 





The PMPIDR2 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFE8. 


Performance Monitors Peripheral Identification Register 3 


The PMPIDR3 characteristics are: 


Purpose 
Provides information to identify a Performance Monitors component. 

Usage constraints 
The PMPIDR3 can be accessed through the internal memory-mapped interface and the external 
debug interface. 


The accessibility to the PMPIDR3 by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMPIDR3 is in the Debug power domain. 

Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMPIDR3 bit assignments. 
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31 8 7 4 3 0 


Figure 11-12 PMPIDR3 bit assignments 


The following table shows the PMPIDR3 bit assignments. 
Table 11-17 PMPIDR3 bit assignments 


Bits Name Function 











[31:8] - Reserved, RESO 
[7:4] REVAND ex@ Part minor revision 
[3:0] CMOD 0x® Customer modified 





The PMPIDR3 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFEC. 


Performance Monitors Peripheral Identification Register 4 
The PMPIDR4 characteristics are: 
Purpose 


Provides information to identify a Performance Monitors component. 


Usage constraints 
PMPIDR4 can be accessed through the internal memory-mapped interface and the external 


debug interface. 


The accessibility to the PMPIDR4 by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMPIDR4 is in the Debug power domain. 


Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 


on page 11-408. 
The following figure shows the PMPIDR4 bit assignments. 
31 8 7 4 3 0 


Figure 11-13 PMPIDR4 bit assignments 


The following table shows the PMPIDR4 bit assignments. 
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Table 11-18 PMPIDR4 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] Size @x@ Size of the component. Log2 the number of 4KB pages from the start of the component to the end of the 
component ID registers. 





[3:0] DES_2 @x4 ARM Limited. This is the least significant nibble JEP106 continuation code. 





The PMPIDR4 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFDO. 
Performance Monitors Peripheral Identification Register 5-7 


No information is held in the Performance Monitors Peripheral ID5, Performance Monitors Peripheral 
ID6, and Performance Monitors Peripheral ID7 Registers. They are reserved for future use and are RESO. 


11.7.13 Performance Monitors Component Identification Registers 


There are four read-only Performance Monitors Component Identification Registers, Performance 
Monitors Component IDO through Performance Monitors Component ID3. The following table shows 
these registers. 


Table 11-19 Summary of the Performance Monitors Component Identification Registers 





Register Value Offset 





PMCIDRO @x@D OxFF@ 





PMCIDRI 0x90 OxFF4 





PMCIDR2 0x05 @xFF8 





PMCIDR3 @xB1 OxFFC 





The Performance Monitors Component Identification Registers identify Performance Monitors as ARM 
PMUv3 architecture. The Component ID registers are: 

e Performance Monitors Component Identification Register 0 on page 11-424. 

e Performance Monitors Component Identification Register 1 on page 11-425. 

e Performance Monitors Component Identification Register 2 on page 11-426. 

e Performance Monitors Component Identification Register 3 on page 11-426. 


Performance Monitors Component Identification Register 0 
The PMCIDRO characteristics are: 


Purpose 
Provides information to identify a Performance Monitors component. 

Usage constraints 
The PMCIDRO can be accessed through the internal memory-mapped interface and the external 
debug interface. 


The accessibility to the PMCIDRO by condition code is: 





Off DLK OSLK EPMAD SLK Default 





ee « RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 
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Configurations 
The PMCIDRO is in the Debug power domain. 


Attributes 
See the register summary in Table 11-7 Memory-mapped PMU register summary 


on page 11-408. 
The following figure shows the PMCIDR0O bit assignments. 
31 8 7 0 


Figure 11-14 PMCIDRO bit assignments 
The following table shows the PMCIDR0O bit assignments. 


Table 11-20 PMCIDRO bit assignments 








Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL_0 @xep Preamble byte 0 





The PMCIDRO can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFF@. 


Performance Monitors Component Identification Register 1 
The PMCIDRI characteristics are: 


Purpose 
Provides information to identify a Performance Monitors component. 


Usage constraints 
The PMCIDRI can be accessed through the internal memory-mapped interface and the external 


debug interface. 


The accessibility to the PMCIDR1 by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMCIDR1 is in the Debug power domain. 


Attributes 
See the register summary in Zable 11-7 Memory-mapped PMU register summary 


on page 11-408. 
The following figure shows the PMCIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 11-15 PMCIDR1 bit assignments 


The following table shows the PMCIDR1 bit assignments. 
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Table 11-21 PMCIDR1 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO 





[7:4] CLASS @x9 Debug component 





[3:0] PRMBL 1 @x@ Preamble 





The PMCIDRI can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFF4. 


Performance Monitors Component Identification Register 2 


The PMCIDR2 characteristics are: 


Purpose 
Provides information to identify a Performance Monitors component. 

Usage constraints 
The PMCIDR2 can be accessed through the internal memory-mapped interface and the external 
debug interface. 


The accessibility to the PMCIDR2 by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 
The PMCIDR2 is in the Debug power domain. 

Attributes 
See the register summary in Zable 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMCIDR2 bit assignments. 


31 8 7 0 


Figure 11-16 PMCIDR2 bit assignments 
The following table shows the PMCIDR2 bit assignments. 


Table 11-22 PMCIDR2 bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL 2 9x@5 Preamble byte 2 





The PMCIDR2 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFF8. 


Performance Monitors Component Identification Register 3 
The PMCIDR3 characteristics are: 
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Purpose 


Provides information to identify a Performance Monitors component. 
Usage constraints 


The PMCIDR3 can be accessed through the internal memory-mapped interface and the external 
debug interface. 


The accessibility to the PMCIDR3 by condition code is: 





Off DLK OSLK EPMAD SLK Default 





- - RO RO 





Table 11-1 External register access conditions on page 11-398 describes the condition codes. 


Configurations 


The PMCIDR3 is in the Debug power domain. 
Attributes 


See the register summary in Table 11-7 Memory-mapped PMU register summary 
on page 11-408. 


The following figure shows the PMCIDR3 bit assignments. 


31 8 7 0 


Figure 11-17 PMCIDR3 bit assignments 
The following table shows the PMCIDR3 bit assignments. 


Table 11-23 PMCIDR3 bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO 





[7:0] PRMBL 3 øxB1 Preamble byte 3 





The PMCIDR3 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFFC. 
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11.8 Events 
The following table shows the events that are generated and the numbers that the PMU uses to reference 
the events. 
The table also shows the bit position of each event on the event bus. Event reference numbers that are not 
listed are reserved. 
Table 11-24 PMU events 
Event Event mnemonic PMUEVENTX[24:0] PMU event Event name 
number bus‘Y bus (to 
trace)°’ 
0x00 SW_INCR - [0] Instruction architecturally executed 
(condition check pass) - Software 
increment 
0x01 L1I CACHE _ REFILL [0] [1] Level 1 instruction cache refill 
0x02 L1I TLB_REFILL [1] [2] Level 1 instruction TLB refill 
0x03 LID CACHE _REFILL [2] [3] Level 1 data cache refill 
0x04 LID_CACHE - [5:4] Level 1 data cache access 
0x05 LID_TLB_REFILL - [7:6] Level 1 data TLB refill 
0x08 INST_RETIRED [6:3] [11:8] Instruction architecturally executed 
0x09 EXC _ TAKEN [7] [12] Exception taken 
OxðA EXC RETURN [8] [13] Instruction architecturally executed 
(condition check pass) - Exception 
return 
@x@B CID_WRITE_RETIRED - [14] Instruction architecturally executed 
(condition check pass) - Write to 
CONTEXTIDR 
0x10 BR_MIS PRED [9] [15] Mispredicted or not predicted branch 
speculatively executed 
0x11 CPU_CYCLES - [16] Cycle 
0x12 BR_PRED [10] [17] Predictable branch speculatively 
executed 
0x13 MEM_ACCESS - [19:18] Data memory access 
0x14 LIL CACHE [11] [20] Level 1 instruction cache access 
0x15 LID CACHE _WB [12] [21] Level 1 data cache Write-Back 
0x16 L2D_CACHE - [23:22] Level 2 data cache access 
0x17 L2D_CACHE REFILL [13] [24] Level 2 data cache refill 
0x18 L2D_CACHE_WB [14] [25] Level 2 data cache Write-Back 
0x19 BUS_ACCESS - [27:26] Bus access 
@x1A MEMORY ERROR - [28] Local memory error 
@x1B INST_SPEC - [30:29] Operation speculatively executed 








ev 


Event count is encoded as a plain binary number to accommodate count values of more than one in the same cycle. 
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Table 11-24 PMU events (continued) 








































































































Event Event mnemonic PMUEVENTX[24:0] PMUevent Event name 

number bus‘Y bus (to 
trace)” 

@x1C TTBR_WRITE_RETIRED - [31] Instruction architecturally executed 
(condition check pass) - Write to 
translation table base 

@x1D BUS_CYCLES - [32] Bus cycle 

@x1E CHAIN - [33] Odd performance counter chain mode 

0x40 LID_CACHE_LD [15] [34] Level 1 data cache access - Read 

0x41 LID _ CACHE _ST [16] [35] Level 1 data cache access - Write 

0x42 LID_CACHE_REFILL_LD - [36] Level 1 data cache refill - Read 

0x43 LID_CACHE_REFILL_ST - [37] Level 1 data cache refill - Write 

0x46 LID _ CACHE _WB_VICTIM - [38] Level 1 data cache Write-back - 
Victim 

0x47 L1D_CACHE_WB_CLEAN - [39] Level 1 data cache Write-back - 
Cleaning and coherency 

0x48 L1D_CACHE_INVAL - [40] Level 1 data cache invalidate 

@x4c L1D_TLB_REFILL_LD [17] [41] Level 1 data TLB refill - Read 

@x4D L1D_TLB_REFILL_ST [18] [42] Level 1 data TLB refill - Write 

0x50 L2D_CACHE_LD [19] [43] Level 2 data cache access - Read 

0x51 L2D_CACHE ST [20] [44] Level 2 data cache access - Write 

0x52 L2D_CACHE_REFILL_LD - [45] Level 2 data cache refill - Read 

0x53 L2D_CACHE_REFILL_ST - [46] Level 2 data cache refill - Write 

0x56 L2D_CACHE_WB_VICTIM - [47] Level 2 data cache Write-back - 
Victim 

0x57 L2D_CACHE_WB_CLEAN - [48] Level 2 data cache Write-back - 
Cleaning and coherency 

0x58 L2D_CACHE_INVAL - [49] Level 2 data cache invalidate 

0x60 BUS_ACCESS_LD - [50] Bus access - Read 

0x61 BUS_ACCESS_ST - [51] Bus access - Write 

0x62 BUS_ACCESS_SHARED - [53:52] Bus access - Shared 

0x63 BUS_ACCESS_NOT_SHARED - [55:54] Bus access - Not shared 

0x64 BUS_ACCESS_NORMAL - [57:56] Bus access - Normal 

0x65 BUS_ACCESS_PERIPH - [59:58] Bus access - Peripheral 

0x66 MEM_ACCESS_LD - [60] Data memory access - Read 

0x67 MEM_ACCESS_ST - [61] Data memory access - Write 

0x68 UNALIGNED_LD_SPEC - [62] Unaligned access - Read 








ev 
ew 


Event count is encoded as a plain binary number to accommodate count values of more than one in the same cycle. 


For this event, unaligned access means data access related memory operation that crosses line boundary. 
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Table 11-24 PMU events (continued) 













































































Event Event mnemonic PMUEVENTX[24:0] PMUevent Event name 
number bus‘Y bus (to 
trace)°’ 

0x69°W UNALIGNED ST SPEC - [63] Unaligned access - Write 

@x6Acv UNALIGNED_ LDST_SPEC - [65:64] Unaligned access 

@x6C LDREX_SPEC [21] [66] Exclusive operation speculatively 
executed - LDREX 

@xéD STREX_PASS_SPEC [22] [67] Exclusive instruction speculatively 
executed - STREX pass 

Ox6E STREX FAIL SPEC [23] [68] Exclusive operation speculatively 
executed - STREX fail 

0x70 LD_SPEC - [70:69] Operation speculatively executed - 
Load 

0x71 ST_SPEC - [72:71] Operation speculatively executed - 
Store 

0x72 LDST_SPEC - [74:73] Operation speculatively executed - 
Load or store 

0x73 DP_SPEC - [76:75] Operation speculatively executed - 
Integer data processing 

0x74 ASE_SPEC - [78:77] Operation speculatively executed - 
Advanced SIMD 

0x75 VFP_SPEC - [80:79] Operation speculatively executed - 
VFP 

0x76 PC_WRITE_SPEC - [82:81] Operation speculatively executed - 
Software change of the PC 

0x77 CRYPTO _ SPEC - [84:83] Operation speculatively executed, 
crypto data processing 

0x78 BR_IMMED_SPEC - [85] Branch speculatively executed - 
Immediate branch 

0x79 BR RETURN SPEC - [86] Branch speculatively executed - 
Procedure return 

0x7A BR_INDIRECT_SPEC - [87] Branch speculatively executed - 
Indirect branch 

@x7C ISB_ SPEC - [88] Barrier speculatively executed - ISB 

@x7D DSB_SPEC [24] [89] Barrier speculatively executed - DSB 

@x7E DMB _ SPEC [24] [90] Barrier speculatively executed - DMB 

0x81 EXC_UNDEF - [91] Exception taken, other synchronous 

0x82 EXC _ SVC - [92] Exception taken, Supervisor Call 

0x83 EXC_PABORT - [93] Exception taken, Instruction Abort 

0x84 EXC_DABORT - [94] Exception taken, Data Abort or SError 











ev 


Event count is encoded as a plain binary number to accommodate count values of more than one in the same cycle. 
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Table 11-24 PMU events (continued) 





















































Event Event mnemonic PMUEVENTX[24:0] PMU event Event name 
number bus‘Y bus (to 
trace)°’ 

0x86 EXC _IRQ - [95] Exception taken, IRQ 

0x87 EXC FIQ - [96] Exception taken, FIQ 

0x88 EXC_SMC - [97] Exception taken, Secure Monitor Call 

Ox8A EXC_HVC - [98] Exception taken, Hypervisor Call 

@x8B EXC TRAP PABORT - [99] Exception taken, Instruction Abort not 
taken locally 

@x8C EXC_TRAP_ DABORT - [100] Exception taken, Data Abort, or 
SError not taken locally 

@x8D EXC_TRAP OTHER - [101] Exception taken — Other traps not 
taken locally 

Ox8E EXC TRAP IRQ - [102] Exception taken, IRQ not taken 
locally 

Ox8F EXC TRAP FIQ - [103] Exception taken, FIQ not taken 
locally 

0x90 RC LD SPEC - [104] Release consistency instruction 
speculatively executed — Load- 
Acquire 

0x91 RC_ST_SPEC - [105] Release consistency instruction 
speculatively executed — Store- 
Release 

€V Event count is encoded as a plain binary number to accommodate count values of more than one in the same cycle. 
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11.9 Interrupts 
The Cortex-A72 processor asserts the nPMUIRQ signal when an interrupt is generated by the PMU. 


You can route this signal to an external interrupt controller for prioritization and masking. This is the 
only mechanism that signals this interrupt to the processor. 


Interrupt is also driven as a trigger input to the CTI. 


Related information 
Chapter 12 Cross Trigger on page 12-434. 
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11.10 Exporting PMU events 


This section describes exporting PMU events. 


This section contains the following subsections: 
e 11.10.1 External hardware on page 11-433. 
e 1.10.2 Debug trace hardware on page 11-433. 


11.10.1 External hardware 


In addition to the counters in the processor, some of the events that 77.8 Events on page 11-428 describes 
are exported on the PMUEVENT bus and can be connected to external hardware. 


11.10.2 Debug trace hardware 


Some of the events that //.8 Events on page 11-428 describes are exported to the ETM unit, other 
external debug, or trace hardware, to enable the events to be monitored. 


Related information 
Chapter 12 Cross Trigger on page 12-434. 
Chapter 13 Embedded Trace Macrocell on page 13-457. 
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Chapter 12 
Cross Trigger 


This chapter describes the cross trigger interfaces for the Cortex-A72 processor. 


It contains the following sections: 

e 12.1 About the cross trigger on page 12-435. 

e 12.2 Trigger inputs and outputs on page 12-436. 

e 12.3 CTI on page 12-437. 

e 12.4 CTM on page 12-438. 

e 12.5 Cross trigger register summary on page 12-439. 

e 12.6 Cross trigger register descriptions on page 12-442. 
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12.1 About the cross trigger 
The Cortex-A72 processor has a single external cross trigger channel interface. 


This external interface is connected to the CoreSight CTI interface corresponding to each processor 
through a simplified Cross Trigger Matrix (CTM). A number of Embedded Cross Trigger (ECT), trigger 
inputs and trigger outputs are connected between debug components in the processor and CoreSight CTI 
blocks. 


The CoreSight Cross Trigger Interface (CTI) enables the debug logic, ETM, and PMU, to interact with 
each other and with other CoreSight components. This is called cross triggering. For example, you 
configure the CTI to generate an interrupt when the ETM trigger event occurs. 


The following figure shows the debug system components and the available trigger inputs and trigger 






















































































































































































outputs. 
Cortex-A72 processor 
Optional core 4 
Optional core 3 
Optional core 2 
core 1 
> PMUEVENT 
PMU > nPMUIRQ 
Non-processor 
| Optional CSCTI 4 
: Optional CSCTI 3 
PMUEVENT[24:0] Optional CSCTI 2 
CSCTI 1 
+B] 
EXTOUT[3:0]——> 
EXTIN[3:0] > CTIIRQ 
i CTIIRQACK 
e DBGRQ 
DBGTRIGGER——— >) 
——DBGRESTART 
CTICHOUT CTICHIN 
m> CTICHOUT[3:0] 
Debug {+ — cTICHOUTACK[3:0] 
CTM 
[——_—_$P__ ———=_ CTICHIN( 3:0] 
> CTICHINACK[3:0] 
> nCOMMIRQ 
om > COMMRX 
> COMMTX 
e EDBGRQ 
Figure 12-1 Debug system components 
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12 Cross Trigger 
12.2 Trigger inputs and outputs 


This section describes the trigger inputs and outputs that are available to the CTI. 


The following table shows the CTI inputs. 


The following table shows the CTI outputs. 





Table 12-1 Trigger inputs 





CTlinput Name 


Description 


























0 DBGTRIGGER, pulsed Pulsed on entry to Debug state 
1 PMUIRQ™ PMU generated interrupt 

2 Z = 

3 : z 

4 EXTOUT[0] ETM external output 

5 EXTOUT[1] ETM external output 

6 EXTOUT[2] ETM external output 

7 EXTOUT[3] ETM external output 





Table 12-2 Trigger outputs 





CTI output Name 


Description 


























0 EDBGRQ Causes the processor to enter Debug state 
1 DBGRESTART Causes the processor to exit Debug state 
2 CTIIRQ CTI interrupt 

3 a 7 

4 EXTIN[0] ETM external input 

5 EXTIN[1] ETM external input 

6 EXTIN[2] ETM external input 

7 EXTIN{[3] ETM external input 





€X This signal is the same as nPMUIRQ with inverted polarity. 
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12.3 CTI 


In the Cortex-A72 processor, the CTI operates in the PCLKDBG domain and it synchronizes the trigger 
inputs and outputs to PCLKDBG. 


Handshaking is required for all trigger outputs. Because the simplified CTM is implemented in the same 
clock domain, synchronization and handshaking is not required for channel interface. In addition, APB 
synchronization is not required. Trigger inputs are not masked by internal NIDEN. Trigger outputs are 
not masked by internal DBGEN. 
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12.4 CTM 


The CoreSight CTI channel signals from all the cores are combined using a simplified Cross Trigger 
Matrix (CTM) so that a single cross trigger channel interface is presented in the Cortex-A72 processor. 


The CTM can combine up to four internal channel interfaces, corresponding to each core, and one 
external channel interface. 


In the simplified CTM: 
e The external channel output is driven by the OR output of all internal channel outputs. 


e Each internal channel input is driven by the OR output of the internal channel outputs of all other 
CTIs, in addition to the external channel input. 


The internal channel acknowledgment signals from the CTIs are not used because the CTIs and the CTM 
are in the same PCLKDBG domain. 
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12.5 Cross trigger register summary 
This section describes the cross trigger registers in the Cortex-A72 processor. 
These registers are accessed through the internal memory-mapped interface or the external debug 
interface. 
The following table shows the cross trigger registers in the Cortex-A72 processor. 
Table 12-3 Cross trigger register summary 
Offset Name Type Width Description 
0x000 CTICONTROL RW 32-bit CTI Control register 
0x000-OX0OC - - - Reserved 
0x010 CTIINTACK WO 32-bit CTI Output Trigger Acknowledge register °Y 
0x014 CTIAPPSET RW 32-bit CTI Application Trigger Set register °Y 
0x018 CTIAPPCLEAR WO 32-bit CTI Application Trigger Clear register ° 
@x@1C CTIAPPPULSE WO 32-bit CTI Application Pulse register °Y 
0x020 CTIINENO RW 32-bit CTI Input Trigger to Output Channel Enable registers °Y 
0x024 CTIINEN1 
0x028 CTIINEN2 
@x@2C CTIINEN3 
0x030 CTIINEN4 
0x034 CTIINENS 
0x038 CTIINEN6 
@x@3C CTIINEN7 
@xO40-Ox@9C - - - Reserved 
Ox0@AQ CTIOUTENO RW 32-bit CTI Input Channel to Output Trigger Enable registers °Y 
@x0A4 CTIOUTEN1 
@x0@A8 CTIOUTEN2 
@x@AC CTIOUTEN3 
@x@Be CTIOUTEN4 
@x@B4 CTIOUTENS 
@x@B8 CTIOUTEN6 
@x@BC CTIOUTEN7 
@x@CO-Ox12C - - - Reserved 
0x130 CTITRIGINSTATUS RO 32-bit CTI Trigger In Status register °Y 
0x134 CTITRIGOUTSTATUS RO 32-bit CTI Trigger Out Status register °Y 
0x138 CTICHINSTATUS RO 32-bit CTI Channel In Status register ° 
@x13C CTICHOUTSTATUS RO 32-bit CTI Channel Out Status register °Y 








ey 


See the ARM” Architecture Reference Manual ARMv8 for more information. 
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Table 12-3 Cross trigger register summary (continued) 


































































































Offset Name Type Width Description 

0x140 CTIGATE RW 32-bit CTI Channel Gate Enable register °Y 

0x144-0xED8 - - - Reserved 

@xEDC CTIUTCHINACK WO 32-bit 12.6.3 CTI Integration Test Channel In Acknowledge register 
on page 12-444 

O@xEEO CTIITTRIGINACK WO 32-bit 12.6.4 CTI Integration Test Trigger In Acknowledge register on page 12-444 

OxEE4 CTITCHOUT WO 32-bit 12.6.5 CTI Integration Test Channel Out register on page 12-445 

OxEE8 CTUTTRIGOUT WO 32-bit 12.6.6 CTI Integration Test Trigger Out register on page 12-446 

@xEEC CTIITCHOUTACK RO 32-bit 12.6.7 CTI Integration Test Channel Out Acknowledge register 
on page 12-446 

OxEFO CTHTTRIGOUTACK RO 32-bit 12.6.8 CTI Integration Test Trigger Out Acknowledge register 
on page 12-447 

@xEF4 CTIUTCHIN RO 32-bit 12.6.9 CTI Integration Test Channel In register on page 12-448 

OxEF8 CTUTTRIGIN RO 32-bit 12.6.10 CTI Integration Test Trigger In register on page 12-448 

@xEFC-@xF7C - - - Reserved 

OxFee CTICTRL RW 32-bit 12.6.2 CTI Integration Mode Control register on page 12-443 

@xFQ4-OxFAC - - - Reserved 

OxFBO CTILAR WO (32-bit CTI Lock Access Register © 

OxFB4 CTILSR RO 32-bit CTI Lock Status Register °Y 

OxFB8 CTIAUTHSTATUS RO 32-bit CTI Authentication Status register © 

OXxXFBC-OXFC4 - - - Reserved 

OxFC8 CTIDEVID RO 32-bit 12.6.1 CTI Device Identification register on page 12-442 

@xFCC CTIDEVTYPE RO 32-bit CTI Device Type register °Y 

@xFDO CTIPIDR4 RO 32-bit CTI Peripheral Identification Register 4 on page 12-452 

@xFD4 CTIPIDRS RO 32-bit CTI Peripheral Identification Register 5-7 on page 12-453 

@xFD8 CTIPIDR6 

@xFDC CTIPIDR7 

OxFEO CTIPIDRO RO 32-bit CTI Peripheral Identification Register 0 on page 12-450 

OxFE4 CTIPIDR1 RO 32-bit CTI Peripheral Identification Register 1 on page 12-450 

OxFE8 CTIPIDR2 RO 32-bit CTI Peripheral Identification Register 2 on page 12-451 

@xFEC CTIPIDR3 RO 32-bit CTI Peripheral Identification Register 3 on page 12-452 

OxFFO CTICIDRO RO 32-bit CTI Component Identification Register 0 on page 12-454 

OxFF4 CTICIDR1 RO 32-bit CTI Component Identification Register 1 on page 12-454 

OxFF8 CTICIDR2 RO 32-bit CTI Component Identification Register 2 on page 12-455 

@xFFC CTICIDR3 RO 32-bit CTI Component Identification Register 3 on page 12-456 





This section contains the following subsections: 


e 12.5.1 External register access permissions on page 12-441. 





ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 


12-440 
Non-Confidential 


12 Cross Trigger 
12.5 Cross trigger register summary 


























12.5.1 External register access permissions 
External access permission to the cross trigger registers is subject to the conditions at the time of the 
access. The following table describe the processor response to accesses through the external debug and 
memory-mapped interfaces. 
Table 12-4 External register access conditions 
Condition Condition Description 
code 
Off EDPRSR.PU is 0 Core power domain is completely off, or in a low-power state where 
the core power domain registers cannot be accessed. 
Note 
If debug is powered down, all external debug and memory-mapped 
register accesses return an error. 
DLK EDPRSR.DLK is 1 OS Double Lock is locked. 
OSLK OSLSR_EL1.OSLK is 1 OS Lock is locked. 
EDAD AllowExternalDebugAccess() External debug access disabled. When an error is returned because of 
==FALSE the EDAD condition code, and this is the highest priority error 
condition, EDPRSR.SDAD is set to 1. Otherwise EDPRSR.SDAD is 
unchanged. 
SLK Memory-mapped interface only Software Lock is locked. For the external debug interface, ignore this 
code. 
Default - None of the conditions apply, normal access. 





The following table shows an example of external register access conditions for access to a cross trigger 
register. To determine the access permission for the register, scan the columns from left to right. Stop at 
the first column whose condition is true, the entry gives the access permission of the register and 


scanning stops. 


Table 12-5 External register access conditions example 





Off DLK OSLK EDAD SLK Default 





- - - - RO/WI RO 
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12.6 Cross trigger register descriptions 
This section describes the Cortex-A72 processor cross trigger registers. 
12.5 Cross trigger register summary on page 12-439 provides cross-references to the individual registers. 


The Integration Test registers are provided to simplify the process of verifying the integration of the ECT 
with other devices in a CoreSight system. These registers enable direct control of outputs and the ability 
to read the value of inputs. You must only use these registers when the CTIITCTRL.IME bit is set to 1. 
See the ARM” Architecture Reference Manual ARMVv8 for more information. 


This section contains the following subsections: 

e 12.6.1 CTI Device Identification register on page 12-442. 

e 12.6.2 CTI Integration Mode Control register on page 12-443. 

¢ 12.6.3 CTI Integration Test Channel In Acknowledge register on page 12-444. 
¢ 12.6.4 CTI Integration Test Trigger In Acknowledge register on page 12-444. 

e 12.6.5 CTI Integration Test Channel Out register on page 12-445. 

e 12.6.6 CTI Integration Test Trigger Out register on page 12-446. 

e 12.6.7 CTI Integration Test Channel Out Acknowledge register on page 12-446. 
¢ 12.6.8 CTI Integration Test Trigger Out Acknowledge register on page 12-447. 
e 12.6.9 CTI Integration Test Channel In register on page 12-448. 

e 12.6.10 CTI Integration Test Trigger In register on page 12-448. 

e 12.6.11 CTI Peripheral Identification Registers on page 12-449. 

e 12.6.12 CTI Component Identification Registers on page 12-453. 


12.6.1 CTI Device Identification register 


The CTIDEVID characteristics are: 


Purpose 
Describes the CTI component to the debugger. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





eS 2 x i RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTIDEVID is in the Debug power domain. 
Attributes 
See 72.5 Cross trigger register summary on page 12-439. 


The following figure shows the CTIDEVID bit assignments. 


26 25 24 23 22 21 16 15 14 13 


INOUT— 


Figure 12-2 CTIDEVID bit assignments 
The following table shows the CTIDEVID bit assignments. 
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Table 12-6 CTIDEVID bit assignments 











Bits Name Function 
[31:26] - Reserved, RESO. 
[25:24] INOUT Input and output options. Indicates the presence of an input gate. The possible values are: 


@be@@ CTIGATE does not mask propagation of input events from external channels. 
@b@1 CTIGATE masks propagation of input events from external channels. 





[23:22] - Reserved, RESO. 





[21:16] NUMCHAN Number of channels implemented. The value is: 
0beee100 Four channels implemented. 





[15:14] - Reserved, RESO. 





[13:8] NUMTRIG Number of triggers implemented. The value is: 
0b001000 Eight triggers implemented. 





[7:5] - Reserved, RESO. 





[4:0] |. EXTMAXNUM Maximum number of external triggers implemented. The value is: 
0b00000 No external triggers implemented. 





12.6.2 CTI Integration Mode Control register 


The CTIITCTRL characteristics are: 


Purpose 
Enables the CTI to switch from its default mode into integration mode, where test software can 
control directly the inputs and outputs of the processor, for integration testing or topology 
detection. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- - - - RO/WI RW 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTIITCTRL is in the Debug power domain. 
Attributes 
See 72.5 Cross trigger register summary on page 12-439. 


shows the CTHTCTRL bit assignments. 


31 10 
em 
IME — 


Figure 12-3 CTIITCTRL bit assignment 
The following table shows the CTIITCTRL bit assignments. 
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Table 12-7 CTIITCTRL bit assignment 





Bits Name Function 





[31:1] - Reserved, RESO. 





[0] IME Integration mode enable. The values are: 


0 Normal operation. 


1 Enables integration mode. 





12.6.3 CTI Integration Test Channel In Acknowledge register 


The CTIITCHINACK characteristics are: 


Purpose 
Provides direct control of the channel in acknowledge signals. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- =- - - RO WO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 

CTIHTCHINACK is in the Debug power domain. 
Attributes 

See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTIITCHINACK bit assignments. 


31 4 3 0 
Pm O 
CTCHINACK— 


Figure 12-4 CTIITCHINACK bit assignments 
The following table shows the CTIITCHINACK bit assignments. 


Table 12-8 CTIITCHINACK bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:0] _CTCHINACK Set the value of the CTCHINACK outputs. 





12.6.4 CTI Integration Test Trigger In Acknowledge register 


The CTIITTRIGINACK characteristics are: 


Purpose 
Provides direct control of the trigger in acknowledge signals. 
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Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- WI WO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 


CTIITTRIGINACK is in the Debug power domain. 
Attributes 


See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTUITTRIGINACK bit assignments. 


31 8:7 0 


Figure 12-5 CTIITTRIGINACK bit assignments 
The following table shows the CTIITTRIGINACK bit assignments. 


Table 12-9 CTIITTRIGINACK bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO. 





[7:0] CTTRIGINACK Set the value of the CTTRIGINACK outputs. 





12.6.5 CTI Integration Test Channel Out register 


The CTIITCHOUT characteristics are: 


Purpose 
Provides direct control of the channel out signals. 
Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- WI WO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTIITCHOUT is in the Debug power domain. 
Attributes 


See 72.5 Cross trigger register summary on page 12-439. 
The following figure shows the CTIITCHOUT bit assignments. 


31 4 3 0 


Figure 12-6 CTIITCHOUT bit assignments 
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The following table shows the CTIITCHOUT bit assignments. 


Table 12-10 CTIITCHOUT bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:0] CTCHOUT Set the value of the CTCHOUT outputs. 





12.6.6 CTI Integration Test Trigger Out register 


The CTIITTRIGOUT characteristics are: 


Purpose 


Provides direct observation of the trigger out signals. 
Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- WI WO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 


CTIITTRIGOUT is in the Debug power domain. 
Attributes 


See 72.5 Cross trigger register summary on page 12-439. 
The following figure shows the CTITTRIGOUT bit assignments. 


31 8 7 0 


Figure 12-7 CTIITTRIGOUT bit assignments 
The following table shows the CTIITTRIGOUT bit assignments. 


Table 12-11 CTIITTRIGOUT bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:0] CTTRIGOUT Set the value of the CTTRIGOUT outputs. 





12.6.7 CTI Integration Test Channel Out Acknowledge register 


The CTIITCHOUTACK characteristics are: 


Purpose 
Provides direct observation of the channel out acknowledge signals. 
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Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 


CTHTCHOUTACK is in the Debug power domain. 
Attributes 


See 72.5 Cross trigger register summary on page 12-439, 
The following figure shows the CTIITCHOUTACK bit assignments. 


31 43 0 
Sm O 
CTCHOUTACK — 


Figure 12-8 CTIITCHOUTACK bit assignments 
The following table shows the CTIITCHOUTACK bit assignments. 


Table 12-12 CTIITCHOUTACK bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:0] CTCHOUTACK Read values of the CTCHOUTACK signals. 





12.6.8 CTI Integration Test Trigger Out Acknowledge register 


The CTITTRIGOUTACK characteristics are: 


Purpose 
Provides direct observation of the trigger out acknowledge signals. 
Usage constraints 


Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- =- - - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 


CTIITTRIGOUTACK is in the Debug power domain. 
Attributes 


See 72.5 Cross trigger register summary on page 12-439. 
The following figure shows the CTUITTRIGOUTACK bit assignments. 
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31 8 7 0 


Figure 12-9 CTIITTRIGOUTACK bit assignments 


The following table shows the CTIITTRIGOUTACK bit assignments. 
Table 12-13 CTIITTRIGOUTACK bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO 





[7:0] CTTRIGOUTACK Read values of the CTTRIGOUTACK signals 





12.6.9 CTI Integration Test Channel In register 


The CTITCHIN characteristics are: 
Purpose 
Provides direct observation of the channel in signals. 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EDAD SLK Default 





- RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTIITCHIN is in the Debug power domain. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTIITCHIN bit assignments. 
31 4 3 0 


Figure 12-10 CTIITCHIN bit assignments 


The following table shows the CTIITCHIN bit assignments. 
Table 12-14 CTIITCHIN bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO 





[3:0] CTCHIN Read values of the CTCHIN signals 





12.6.10 CTI Integration Test Trigger In register 


The CTITTRIGIN characteristics are: 
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Purpose 
Provides direct observation of the trigger in signals. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EDAD SLK Default 





- =- - - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 

CTIITTRIGIN is in the Debug power domain. 
Attributes 

See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTIITTRIGIN bit assignments. 
31 8:7 0 


Figure 12-11 CTIITTRIGIN bit assignments 
The following table shows the CTIITTRIGIN bit assignments. 


Table 12-15 CTIITTRIGIN bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO 





[7:0] CTTRIGIN Read values of the CTTRIGIN signals 





12.6.11 CTI Peripheral Identification Registers 


The Peripheral Identification Registers provide standard information required for all components that 
conform to the ARM CoreSight architecture. There is a set of eight registers, listed in register number 
order in the following table. 


Table 12-16 Summary of the CTI Peripheral Identification Registers 





Register Value Offset 





CTIPIDR4 0x04 @xFDO 





CTIPIDR5 0x00 O@xFD4 





CTIPIDR6 0x00 OxFD8 





CTIPIDR7 0x00 @xFDC 





CTIPIDRO 0x06 @xFE®@ 





CTIPIDR1 @xB9 @xFE4 





CTIPIDR2 0x4B @xFE8 





CTIPIDR3 0x00 @xFEC 





Only bits[7:0] of each CTI Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
CTI Peripheral ID Registers define a single 64-bit Peripheral ID. 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


The CTI Peripheral ID registers are: 

e CTI Peripheral Identification Register 0 on page 12-450. 

e CTI Peripheral Identification Register 1 on page 12-450. 

e CTI Peripheral Identification Register 2 on page 12-451. 

e CTI Peripheral Identification Register 3 on page 12-452. 

e CTI Peripheral Identification Register 4 on page 12-452. 

e CTI Peripheral Identification Register 5-7 on page 12-453. 


CTI Peripheral Identification Register 0 
The CTIPIDRO characteristics are: 


Purpose Provides information to identify a CTI component. 
Usage constraints Accessible through the internal memory-mapped interface and the external debug 
interface. The access conditions are: 


Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access 
conditions. 


Configurations CTIPIDRO is in the Debug power domain. 
CTIPIDR0O is optional to implement in the external register interface. 
Attributes See 72.5 Cross trigger register summary on page 12-439. 
The following figure shows the CTIPIDRO bit assignments. 
31 8 7 0 


Figure 12-12 CTIPIDRO bit assignments 
The following table shows the CTIPIDRO bit assignments. 


Table 12-17 CTIPIDRO bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO 





[7:0] Part0 øxø6 Least significant byte of the cross trigger part number 





CTI Peripheral Identification Register 1 
The CTIPIDR1 characteristics are: 


Purpose 
Provides information to identify a CTI component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EPMAD SLK Default 





a a = g RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


Configurations 
CTIPIDR1 is in the Debug power domain. 


CTIPIDR1 is optional to implement in the external register interface. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTIPIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 12-13 CTIPIDR1 bit assignments 
The following table shows the CTIPIDR1 bit assignments. 


Table 12-18 CTIPIDR1 bit assignments 


Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] DES_0 exp ARM Limited. This is the least significant nibble of JEP106 ID code. 





[3:0] Part_l @x9 Most significant nibble of the cross trigger interface part number. 





CTI Peripheral Identification Register 2 
The CTIPIDR2 characteristics are: 


Purpose Provides information to identify a CTI component. 


Usage constraints Accessible through the internal memory-mapped interface and the external debug 
interface. The access conditions are: 





Off DLK OSLK EPMAD SLK Default 





- RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access 
conditions. 


Configurations CTIPIDR2 is in the Debug power domain. 
CTIPIDR2 is optional to implement in the external register interface. 


Attributes See 72.5 Cross trigger register summary on page 12-439. 


The following figure shows the CTIPIDR2 bit assignments. 


31 8 7 432 0 
JEDEC — 


Figure 12-14 CTIPIDR2 bit assignments 
The following table shows the CTIPIDR2 bit assignments. 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


Table 12-19 CTI PIDR2 bit assignments 





Bits Name Function 











[31:8] - Reserved, RESO. 
[7:4] Revision 9x4 Part major revision. 
[3] JEDEC @b1 RES1. Indicates a JEP106 identity code is used. 





[2:0] DES_1  g@pe11 ARM Limited. This is the most significant nibble of JEP106 ID code. 





CTI Peripheral Identification Register 3 
The CTIPIDR3 characteristics are: 


Purpose 
Provides information to identify a CTI component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 


Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTIPIDR3 is in the Debug power domain. 


CTIPIDR3 is optional to implement in the external register interface. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439. 


The following figure shows the CTIPIDR3 bit assignments. 


31 8 7 4 3 0 


Figure 12-15 CTIPIDR3 bit assignments 
The following table shows the CTIPIDR3 bit assignments. 


Table 12-20 CTIPIDR3 bit assignments 





Bits Name Function 











[31:8] - Reserved, RESO 
[7:4] REVAND exe Part minor revision 
[3:0] CMOD 0x0 Customer modified 





CTI Peripheral Identification Register 4 
The CTIPIDR4 characteristics are: 


Purpose 
Provides information to identify a CTI component. 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EPMAD SLK Default 





- - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTIPIDR4 is in the Debug power domain. 


CTIPIDR4 is optional to implement in the external register interface. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTIPIDR4 bit assignments. 
31 8 7 4 3 0 


Figure 12-16 CTIPIDR4 bit assignments 
The following table shows the CTIPIDR4 bit assignments. 


Table 12-21 CTIPIDR4 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] Size @x@ Size of the component. Log2 the number of 4KB pages from the start of the component to the end of the 
component ID registers. 





[3:0] DES_2 9x4 ARM Limited. This is the least significant nibble JEP106 continuation code. 





CTI Peripheral Identification Register 5-7 


No information is held in the Peripheral ID5, Peripheral ID6, and Peripheral ID7 Registers. They are 
reserved for future use and are RESO. 


12.6.12 CTI Component Identification Registers 


There are four read-only CTI Component Identification Registers, Component IDO through Component 
ID3. The following table shows these registers. 


Table 12-22 Summary of the CTI Component Identification Registers 


Register Value Offset 





CTICIDRO @x@D OxFFO@ 





CTICIDR1 0x90 @OxFF4 





CTICIDR2 0x05 OxFF8 





CTICIDR3 @xB1 @xFFC 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


The CTI Component ID registers are: 

e CTI Component Identification Register 0 on page 12-454. 
e CTI Component Identification Register 1 on page 12-454. 
e CTI Component Identification Register 2 on page 12-455. 
e CTI Component Identification Register 3 on page 12-456. 


CTI Component Identification Register 0 
The CTICIDRO characteristics are: 


Purpose 
Provides information to identify a CTI component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTICIDR0O is in the Debug power domain. 


CTICIDR0O is optional to implement in the external register interface. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTICIDRO bit assignments. 
31 8 7 0 


Figure 12-17 CTICIDRO bit assignments 
The following table shows the CTICIDRO bit assignments. 


Table 12-23 CTICIDRO bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL_0 gxep Preamble byte 0 





CTI Component Identification Register 1 
The CTICIDR1 characteristics are: 


Purpose 
Provides information to identify a CTI component. 
Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 


access conditions are: 





Off DLK OSLK EPMAD SLK Default 





7. = , RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


Configurations 
CTICIDRI1 is in the Debug power domain. 


CTICIDRI is optional to implement in the external register interface. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTICIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 12-18 CTICIDR1 bit assignments 
The following table shows the CTICIDR1 bit assignments. 


Table 12-24 CTICIDR1 bit assignments 























Bits Name Function 
[31:8] - Reserved, RESO 
[7:4] CLASS 0x9 Debug component 
[5:0] PRMBL 1 øxø Preamble 
CTI Component Identification Register 2 
The CTICIDR2 characteristics are: 
Purpose 
Provides information to identify a CTI component. 
Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 
Off DLK OSLK EPMAD SLK Default 
> & « 5 RO RO 
Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 
Configurations 
CTICIDR2 is in the Debug power domain. 
CTICIDR2 is optional to implement in the external register interface. 
Attributes 
See 72.5 Cross trigger register summary on page 12-439. 
The following figure shows the CTICIDR2 bit assignments. 
31 8 7 0 
Figure 12-19 CTICIDR2 bit assignments 
The following table shows the CTICIDR2 bit assignments. 
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12 Cross Trigger 
12.6 Cross trigger register descriptions 


Table 12-25 CTICIDR2 bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL 2 9x@5 Preamble byte 2 





CTI Component Identification Register 3 
The CTICIDR3 characteristics are: 


Purpose 
Provides information to identify a CTI component. 

Usage constraints 
Accessible through the internal memory-mapped interface and the external debug interface. The 
access conditions are: 





Off DLK OSLK EPMAD SLK Default 





- =- - - RO RO 





Table 12-3 Cross trigger register summary on page 12-439 describes the access conditions. 


Configurations 
CTICIDR3 is in the Debug power domain. 


CTICIDR3 is optional to implement in the external register interface. 


Attributes 
See 72.5 Cross trigger register summary on page 12-439, 


The following figure shows the CTICIDR3 bit assignments. 


31 8 7 0 


Figure 12-20 CTICIDR3 bit assignments 
The following table shows the CTICIDR3 bit assignments. 


Table 12-26 CTICIDR3 bit assignments 

















Bits Name Function 
[31:8] - Reserved, RESO 
[7:0] PRMBL 3 øxB1 Preamble byte 3 
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Chapter 13 
Embedded Trace Macrocell 


This section describes the Embedded Trace Macrocell (ETM) for the Cortex-A72 processor. 


It contains the following sections: 

e 13.1 About ETM on page 13-458. 

e 13.2 ETM trace generation options and resources on page 13-459. 

¢ 13.3 ETM functional description on page 13-461. 

e 13.4 Reset on page 13-462. 

¢ 13.5 ETM register interfaces on page 13-463. 

e 13.6 Register summary on page 13-464. 

e 13.7 Register descriptions on page 13-468. 

¢ 13.8 Interaction with debug and the Performance Monitor Unit on page 13-510. 
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13 Embedded Trace Macrocell 
13.1 About ETM 


13.1 About ETM 


Describes the Embedded Trace Macrocell used in the Cortex-A72 processor. 


The ETM is a module that performs real-time instruction flow tracing based on the ARM® Embedded 
Trace Macrocell Architecture Specification, ETMv4. The ETM is a CoreSight component, and is an 
integral part of the ARM Real-time Debug solution, Real View. See the CoreSight SoC-400 
documentation for more information. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 13-458 
Non-Confidential 


13 Embedded Trace Macrocell 
13.2 ETM trace generation options and resources 


13.2 ETM trace generation options and resources 


The following table shows the trace generation options that the Cortex-A72 processor implements. 


Table 13-1 ETM trace generation options implemented 




















Description Configuration 
Instruction address size in bytes 8 
Data address size in bytes 0 
Data value size in bytes 0 
Virtual Machine ID size in bytes 1 
Context ID size in bytes 4 





Support for conditional instruction tracing 


Not implemented 





Support for tracing of data 


Not implemented 





Support for tracing of load and store instructions as PO elements 


Not implemented 









































Support for cycle counting in the instruction trace Implemented 
Support for branch broadcast tracing Implemented 
Exception Levels implemented in Non-secure state 0b0111 
Exception Levels implemented in Secure state 0b1011 
Number of events supported in the trace 4 

Return stack support Implemented 
Tracing of SError exception support Implemented 
Instruction trace cycle counting minimum threshold 4 

Size of Trace ID 7-bit 
Synchronization period support Read-write 
Global timestamp size 64-bit 
Number of cores available for tracing 1 

ATB trigger support Implemented 





Low power behavior override 


Not implemented 





Stall control support 


Not implemented 





Support for no overflows in the trace 


Not implemented 





The following table shows the ETM resources that the Cortex-A72 processor implements. 


Table 13-2 ETM resources implemented 




















Description Configuration 
Number of resource selection pairs implemented 8 
Number of external input selectors implemented 4 
Number of external inputs implemented 110, 4 external + 106 PMU 
Number of counters implemented 2 
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13 Embedded Trace Macrocell 
13.2 ETM trace generation options and resources 


Table 13-2 ETM resources implemented (continued) 












































Description Configuration 
Reduced function counter implemented Not implemented 
Number of sequencer states implemented 4 

Number of Virtual Machine ID comparators implemented 1 

Number of Context ID comparators implemented 1 

Number of address comparator pairs implemented 4 

Number of single-shot comparator controls 1 

Number of processor comparator inputs implemented 0 

Data address comparisons implemented Not implemented 
Number of data value comparators implemented 0 
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13 Embedded Trace Macrocell 
13.3 ETM functional description 


13.3 ETM functional description 
Describes the functional blocks of the ETM. 
The following figure shows the main functional blocks of the ETM. 
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Figure 13-1 ETM functional blocks 


The ETM blocks are: 


Processor interface 
This block monitors the behavior of the processor and generates PO elements that are essentially 


executed instructions and exceptions traced in program order. 


Trace generation 
The trace generation block generates various trace packets based on PO elements. 


Filtering and triggering resources 
You can filter the ETM trace such as configuring it to trace only in certain address ranges. More 
complicated logic analyzer style filtering options are also available. 


The ETM can also generate a trigger that is a signal to the trace capture device to stop capturing 
trace. 


FIFO 
The trace generated by the ETM is in a highly-compressed form. The FIFO enables trace bursts 


to be flattened out. When the FIFO becomes full, the FIFO signals an overflow. The trace 
generation logic does not generate any new trace until the FIFO is emptied. This causes a gap in 
the trace when viewed in the debugger. 
Trace out 
Trace from FIFO is output on the synchronous AMBA Advanced Trace Bus (ATB) interface. 
Syncbridge 
The ATB interface from the trace out block goes through two slices of the CoreSight SoC ATB 
Syncbridge IP. 


See the ARM® AMBA” 3 ATB Protocol Specification for information about the ATB protocol. 
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13 Embedded Trace Macrocell 
13.4 Reset 


13.4 Reset 


The reset for ETM is the same as Cold reset for processor. 


The ETM is not reset when a Warm reset is applied to processor, so that tracing through the reset is 
possible. 

If the ETM is reset, tracing stops until the ETM is reprogrammed and re-enabled. However, if the 
processor is reset using a Warm reset, the last few instructions provided by the processor before the reset 
might not be traced. 
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13.5 ETM register interfaces 


13.5 ETM register interfaces 


The reset for ETM is the same as Cold reset for processor. 


This section contains the following subsections: 
e 13.5.1 Access permissions on page 13-463. 


13.5.1 Access permissions 


See the ARM” Embedded Trace Macrocell Architecture Specification, ETMv4 for information on the 
behaviors on register accesses for different trace unit states and the different access mechanisms. 


Related information 
10.10 External debug interface on page 10-381. 
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13 Embedded Trace Macrocell 
13.6 Register summary 


This section summarizes the ETM registers. 


For full descriptions of the ETM registers, see: 


e 10.10 External debug interface on page 10-381, for the IMPLEMENTATION DEFINED registers and the 
ARM” Embedded Trace Macrocell Architecture Specification, ETMv4, for the other registers. 


Note 





e In the following table, access type is described as follows: 


RW 
RO 
WoO 


Read and write. 


Read only. 


Write only. 





All ETM registers are 32 bits wide. The following table lists all of the registers and their offsets from a 
base address. The base address is defined by the system integrator when placing the ETM in the Debug- 










































































APB memory map. 
Table 13-3 ETM register summary 
Offset Name Type Description 
0x000 - - Reserved 
0x004 TRCPRGCTLR RW Trace Programming Control Register 
0x008 z - Reserved 
OXxX0OC TRCSTATR RO Trace Status Register 
0x010 TRCCONFIGR RW 13.7.1 Trace Configuration Register on page 13-468 
0x014 - - Reserved 
0x018 TRCAUXCTLR RW 13.7.2 Trace Auxiliary Control Register on page 13-470 
@x@1C - - Reserved 
0x020 TRCEVENTCTLOR RW 13.7.3 Trace Event Control 0 Register on page 13-472 
0x024 TRCEVENTCTLIR RW 13.7.4 Trace Event Control 1 Register on page 13-473 
0x028-0x2C - - Reserved 
0x030 TRCTSCTLR RW Global Timestamp Control Register 
0x034 TRCSYNCPR RW 13.7.5 Trace Synchronization Period Register on page 13-474 
0x038 TRCCCCTLR RW 13.7.6 Trace Cycle Count Control Register on page 13-475 
@x@3C TRCBBCTLR RW Branch Broadcast Control Register 
0x040 TRCTRACEIDR RW 13.7.7 Trace ID Register on page 13-476 
0x044 -0x07C - - Reserved 
0x080 TRCVICTLR RW 13.7.8 ViewInst Main Control Register on page 13-476 
0x084 TRCVHECTLR RW Viewlnst Include-Exclude Control Register 
0x088 TRCVISSCTLR RW Viewlnst Start-Stop Control Register 
@x@8C -OxOFC - - Reserved 
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13.6 Register summary 


Table 13-3 ETM register summary (continued) 











































































































Offset Name Type Description 

0x100 TRCSEQEVRO RW Sequencer State Transition Control Register 0 
0x104 TRCSEQEVR1 RW Sequencer State Transition Control Register 1 
0x108 TRCSEQEVR2 RW Sequencer State Transition Control Register 2 
0x10C -0x114 - - Reserved 

0x118 TRCSEQRSTEVR RW Sequencer Reset Control Register 

0x11C TRCSEQSTR RW Sequencer State Register 

0x120 TRCEXTINSELR RW 13.7.9 External Input Select Register on page 13-478 
0x124 -0x13C - - Reserved 

0x140 TRCCNTRLDVRO RW Counter Reload Value Register 0 

0x144 TRCCNTRLDVRI RW Counter Reload Value Register 1 
@x148-0x14C - - Reserved 

0x150 TRCCNTCTLRO RW Counter Control Register 0 

0x154 TRCCNTCTLR1 RW Counter Control Register 1 

0x158-0x15C - - Reserved 

0x160 TRCCNTVRO RW Counter Value Register 0 

0x164 TRCCNTVRI RW Counter Value Register 1 

@x168-0x16C - - Reserved 

0x170 -0x17C - - Reserved 

0x180 TRCIDR8 RO 13.7.10 ID Register 8 on page 13-479 

0x184 TRCIDR9 RO 13.7.11 ID Register 9 on page 13-479 

0x188 TRCIDR10 RO 13.7.12 ID Register 10 on page 13-480 
0x18C TRCIDRI1 RO 13.7.13 ID Register 11 on page 13-480> 
0x190 TRCIDR12 RO 13.7.14 ID Register 12 on page 13-481 
0x194 TRCIDR13 RO 13.7.15 ID Register 13 on page 13-482 
0x198-0x1BC - - Reserved 

Ox1C0 TRCIMSPECO RW 13.7.16 Implementation Defined Register 0 on page 13-482 
@x1C4-0x1DC - - Reserved 

Ox1E@ TRCIDRO RO 13.7.17 Trace ID Register 0 on page 13-483 
0x1E4 TRCIDRI RO 13.7.18 Trace ID Register I on page 13-484 
@x1E8 TRCIDR2 RO 13.7.19 Trace ID Register 2 on page 13-485 
@x1EC TRCIDR3 RO 13.7.20 Trace ID Register 3 on page 13-486 
Ox1F@ TRCIDR4 RO 13.7.21 Trace ID Register 4 on page 13-488 
Ox1F4 TRCIDRS RO 13.7.22 Trace ID Register 5 on page 13-489 





Ox1F8 -0x204 


Reserved 
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13 Embedded Trace Macrocell 
13.6 Register summary 


Table 13-3 ETM register summary (continued) 








































































































Offset Name Type Description 

0x208-0x23C TRCRSCTLRn RW 13.7.23 Resource Selection Control Registers on page 13-491, nis 2, 15 
0x240-0x27C - - Reserved 

0x280 TRCSSCCRO RW Single-shot Comparator Control Register 0 

@x284-Ox29C - - Reserved 

Qx2A0 TRCSSCSRO RW, RO Single-shot Comparator Status Register 0 

Ox2A4-Ox2FC - - Reserved 

0x300 TRCOSLAR WO OS Lock Access Register 

0x304 TRCOSLSR RO OS Lock Status Register 

0x308 -0X30C - - Reserved 

0x310 TRCPDCR RW PowerDown Control Register 

0x314 TRCPDSR RO PowerDown Status Register 

0x318 -@x3FC - - Reserved 

0x400-0x438 TRCACVRn RW Address Comparator Value Register n, n = 0 to 7 

0x440-0x47C - - Reserved 

0x480-0x4B8 TRCACATRn RW 13.7.24 Address Comparator Access Type Registers on page 13-492, nis 0 to 7 
@x4CO-Ox5FC - - Reserved 

0x600 TRCCIDCVRO RW 13.7.25 Context ID Comparator Value Register 0 on page 13-494 
0x608-0x63F - - Reserved 

0x640 TRCVMIDCVRO RW 13.7.26 VMID Comparator Value Register 0 on page 13-495 
Qx648-Ox67F - - Reserved 

0x680 TRCCIDCCTLRO RW 13.7.27 Context ID Comparator Control Register 0 on page 13-496 
@x684-OxED8 - - Reserved 

@xEDC TRCITMISCOUT WO 13.7.28 Trace Integration Miscellaneous Outputs Register on page 13-496 
OxEE@ TRCITMISCIN RO 13.7.29 Trace Integration Miscellaneous Input Register on page 13-497 
OxEE4-OxEE8 - - Reserved 

OxEEC TRCITATBDATAO WO 13.7.30 Trace Integration Test ATB Data Register 0 on page 13-498 
OxEFO TRCITATBCTR2 RO 13.7.31 Trace Integration Test ATB Control Register 2 on page 13-498 
OxEF4 TRCITATBCTRI1 WO 13.7.32 Trace Integration Test ATB Control Register 1 on page 13-499 
OxEF8 TRCITATBCTRO WO 13.7.33 Trace Integration Test ATB Control Register 0 on page 13-500 
OxEFC - - Reserved 

OxFee TRCITCTRL RW 13.7.34 Trace Integration Mode Control register on page 13-501 
OxF04 -ƏXF9C - - Reserved 

OxFA@ TRCCLAIMSET RW Trace Claim Tag Set register 

OxFA4 TRCCLAIMCLR RW Trace Claim Tag Clear register 
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13.6 Register summary 


Table 13-3 ETM register summary (continued) 




































































Offset Name Type Description 

OxFA8 TRCDEVAFFO RO 13.7.35 Trace Device Affinity register 0 on page 13-501 
@xFAC TRCDEVAFF1 RO 13.7.36 Trace Device Affinity register 1 on page 13-502 
@xFBO TRCLAR WO Trace Software Lock Access Register 

OxFB4 TRCLSR RO Trace Software Lock Status Register 

OxFB8 TRCAUTHSTATUS RO Trace Authentication Status register 

@xFBC TRCDEVARCH RO Trace Device Architecture register 

OxFC@-@xFC4 - - Reserved 

OxFC8 TRCDEVID RO Trace Device ID register 

@xFCC TRCDEVTY PE RO Trace Device Type register 

@xFD@ TRCPIDR4 RO Trace Peripheral Identification Register 4 on page 13-506 
@xFD4 TRCPIDRS RO Trace Peripheral Identification Register 5-7 on page 13-506 
@xFD8 TRCPIDR6 RO 

@xFDC TRCPIDR7 RO 

OxFE@ TRCPIDRO RO Trace Peripheral Identification Register 0 on page 13-503 
OxFE4 TRCPIDRI RO Trace Peripheral Identification Register 1 on page 13-504 
OxFE8 TRCPIDR2 RO Trace Peripheral Identification Register 2 on page 13-504 
OxFEC TRCPIDR3 RO Trace Peripheral Identification Register 3 on page 13-505 
OxFF@ TRCCIDRO RO Trace Component Identification Register 0 on page 13-507 
OxFF4 TRCCIDRI1 RO Trace Component Identification Register 1 on page 13-507 
OxFF8 TRCCIDR2 RO Trace Component Identification Register 2 on page 13-508 
OxFFC TRCCIDR3 RO Trace Component Identification Register 3 on page 13-509 





Related information 


10.11 ROM table on page 10-384. 
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13.7 Register descriptions 
This section describes the implementation-specific ETM registers in the Cortex-A72 processor. 
13.6 Register summary on page 13-464 provides cross-references to individual registers. 


The ARM” Embedded Trace Macrocell Architecture Specification, ETMyv4 describes the other ETM 
registers. 


This section contains the following subsections: 

¢ 13.7.1 Trace Configuration Register on page 13-468. 

e 13.7.2 Trace Auxiliary Control Register on page 13-470. 

e 13.7.3 Trace Event Control 0 Register on page 13-472. 

¢ 13.7.4 Trace Event Control 1 Register on page 13-473. 

e 13.7.5 Trace Synchronization Period Register on page 13-474. 

e 13.7.6 Trace Cycle Count Control Register on page 13-475. 

e 13.7.7 Trace ID Register on page 13-476. 

¢ 13.7.8 ViewInst Main Control Register on page 13-476. 

e 13.7.9 External Input Select Register on page 13-478. 

e 13.7.10 ID Register 8 on page 13-479. 

e 13.7.11 ID Register 9 on page 13-479. 

e 13.7.12 ID Register 10 on page 13-480. 

e 13.7.13 ID Register 11 on page 13-480. 

e 13.7.14 ID Register 12 on page 13-481. 

e 13.7.15 ID Register 13 on page 13-482. 

e 13.7.16 Implementation Defined Register 0 on page 13-482. 

e 13.7.17 Trace ID Register 0 on page 13-483. 

e 13.7.18 Trace ID Register I on page 13-484. 

e 13.7.19 Trace ID Register 2 on page 13-485. 

e 13.7.20 Trace ID Register 3 on page 13-486. 

e 13.7.21 Trace ID Register 4 on page 13-488. 

e 13.7.22 Trace ID Register 5 on page 13-489. 

e 13.7.23 Resource Selection Control Registers on page 13-491. 

e 13.7.24 Address Comparator Access Type Registers on page 13-492. 

e 13.7.25 Context ID Comparator Value Register 0 on page 13-494. 

e 13.7.26 VMID Comparator Value Register 0 on page 13-495. 

e 13.7.27 Context ID Comparator Control Register 0 on page 13-496. 

e 13.7.28 Trace Integration Miscellaneous Outputs Register on page 13-496. 
e 13.7.29 Trace Integration Miscellaneous Input Register on page 13-497. 
e 13.7.30 Trace Integration Test ATB Data Register 0 on page 13-498. 

e 13.7.31 Trace Integration Test ATB Control Register 2 on page 13-498. 
e 13.7.32 Trace Integration Test ATB Control Register 1 on page 13-499. 
e 13.7.33 Trace Integration Test ATB Control Register 0 on page 13-500. 
¢ 13.7.34 Trace Integration Mode Control register on page 13-501. 

e 13.7.35 Trace Device Affinity register 0 on page 13-501. 

e 13.7.36 Trace Device Affinity register 1 on page 13-502. 

e 13.7.37 Trace Peripheral Identification Registers on page 13-502. 

e 13.7.38 Trace Component Identification Registers on page 13-506. 


13.7.1 Trace Configuration Register 


The TRCCONFIGR characteristics are: 


Purpose 
Controls the tracing options. 
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Usage constraints 

Only accepts writes when the trace unit is disabled. 
Configurations 

Available in all configurations. 
Attributes 

A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCCONFIGR bit assignments. 


31 13 12 11 10 ei 
| “so! | a 
es co | 

| 


Figure 13-2 TRCCONFIGR bit assignments 
The following table shows the TRCCONFIGR bit assignments. 


Table 13-4 TRCCONFIGR bit assignments 





Bits Name Function 





[31:13] - Reserved, RESO. 





[12] RS Enables the return stack. The possible values are: 








0 Disables the return stack. 
1 Enables the return stack. 
[11] TS Enables global timestamp tracing. The possible values are: 
0 Disables global timestamp tracing. 
1 Enables global timestamp tracing. 
[10:8] - Reserved, RESO. 





[7] VMID Enables VMID tracing. The possible values are: 

















0 Disables VMID tracing. 
1 Enables VMID tracing. 

[6] CID Enables context ID tracing. The possible values are: 
0 Disables context ID tracing. 
1 Enables context ID tracing. 

[5] - Reserved, RESO. 

[4] CCI Enables cycle counting instruction trace. The possible values are: 
0 Disables cycle counting instruction trace 
1 Enables cycle counting instruction trace 
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Table 13-4 TRCCONFIGR bit assignments (continued) 





Bits Name Function 





[3] BB 


Enables branch broadcast mode. The possible values are: 


0 Disables branch broadcast mode. 


1 Enables branch broadcast mode. 





Reserved, RESO. 





Reserved, RES1. 





13.7.2 


31 


The TRCCONFIGR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x019. 


Trace Auxiliary Control Register 


The TRCAUXCTLR characteristics are: 


Purpose 
The function of this register is to provide IMPLEMENTATION DEFINED configuration and control 
options. 

Usage constraints 
There are no usage constraints. 

Configurations 
Available in all configurations. 

Attributes 
A 32-bit RW trace register. This register is set to zero on a trace unit reset. Resetting this register 
to zero ensures that none of the features are enabled by default, and that the trace unit resets to a 
known state. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCAUXCTLR bit assignments. 


109876547210 





SBRCGFRCENABLE— LAFREADYOVERRIDE 
DBGFLUSHOVERRIDE IDLEACKOVERRIDE 


CIFOVERRIDE FRCSYNCOVERFLOW 
CLKENOVERRIDE SYNCIOVERRIDE 
FLUSHOVERRIDE TSIOVERRIDE 





Figure 13-3 TRCAUXCTLR bit assignments 


The following table shows the TRCAUXCTLR bit assignments. 
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Table 13-5 TRCAUXCTLR bit assignments 





Bits Name 


Function 





[31:10] - 


Reserved, RESO. 





[9] SBRCGFRCENABLE 


Force ETM trace sync bridge RCG enable active. The possible values are: 


0 
Enables ETM trace sync bridge RCG for additional clock gating and potentially reduce 
dynamic power dissipation. This is the reset value. 


Forces ETM trace sync bridge RCG enable high. 





[8] DBGFLUSHOVERRIDE 


Override ETM flush behavior on Debug state entry. The possible values are: 


0 
ETM FIFO is flushed when the processor enters Debug state. 


ETM FIFO is not flushed when the processor enters Debug state. This trace unit 
behavior deviates from the architecturally-specified behavior. 





[7] CIFOVERRIDE 


Override core interface register repeater clock enable. The possible values are: 


0 
Core interface is clock gated when DBGEN or NIDEN is LOW. 


Core interface is not clock gated when DBGEN or NIDEN is LOW. 





[6] CLKENOVERRIDE 


Override ETM clock enable. The possible values are: 


0 
ETM clock gating is enabled. 


ETM clock gating is disabled. 





[5] FLUSHOVERRIDE 


Override ETM flush behavior. The possible values are: 


0 
ETM FIFO is flushed and ETM enters idle state when DBGEN or NIDEN is LOW. 





ETM FIFO is not flushed and ETM does not enter idle state when DBGEN or NIDEN is 
LOW. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 





[4] TSIOVERRIDE 


Override TS packet insertion behavior. The possible values are: 


0 
Timestamp packets are inserted into FIFO when trace activity is LOW. 


Timestamp packets are inserted into FIFO irrespective of trace activity. 





[3] SYNCIOVERRIDE 


Override SYNC packet insertion behavior. The possible values are: 


0 
SYNC packets are inserted into FIFO when trace activity is LOW. 


SYNC packets are inserted into FIFO irrespective of trace activity. 
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Table 13-5 TRCAUXCTLR bit assignments (continued) 





Bits Name Function 





[2] FRCSYNCOVERFLOW Force overflows to output synchronization packets. The possible values are: 


0 
No FIFO overflow when SYNC packets are delayed. 


Forces FIFO overflow when SYNC packets are delayed. 


When this bit is set to 1, the trace unit behavior deviates from architecturally-specified behavior. 





[1] IDLEACKOVERRIDE Force ETM idle acknowledge. The possible values are: 
0 
ETM idle acknowledge is asserted only when ETM is in idle state. 
ETM idle acknowledge is asserted irrespective of ETM idle state 


When this bit is set to 1, trace unit behavior deviates from architecturally-specified behavior. 





[0] AFREADYOVERRIDE Force assertion of AFREADYM output. The possible values are: 


0 
ETM AFREADYM output is asserted only when ETM is in idle state or when all the 
trace bytes in FIFO before a flush request are output. 


ETM AFREADYM output is always asserted HIGH. When this bit is set to 1, trace unit 
behavior deviates from architecturally-specified behavior. 





The TRCAUXCTLR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x018. 


13.7.3 Trace Event Control 0 Register 


The TRCEVENTCTLOR characteristics are: 


Purpose 
Controls the tracing of arbitrary events. Each of the event fields in this register is an event 
selector. 


If any of the selected events occur and the corresponding bit in TRCEVENTCTLIR.INSTEN is 
1, then an event element is generated in the instruction trace stream. 


If any of the selected events occur and the corresponding bit in TRCEVENTCTLIR.DATAEN 
is 1, then an event element is generated in the data trace stream. 


Usage constraints 

Only accepts writes when the trace unit is disabled. 
Configurations 

Available in all configurations. 
Attributes 

A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCEVENTCTLOR bit assignments. 
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31 24 23 16 15 8 7 0 


Figure 13-4 TRCEVENTCLOR bit assignments 
The following table shows the TRCEVENTCTLOR bit assignments. 


Table 13-6 TRCEVENTCLOR bit assignments 





Bits Name Function 





[31:24] Event3 Identifies the fourth event to trace 





[23:16] Event2 Identifies the third event to trace 





[15:8] Event! Identifies the second event to trace 





[7:0] Event0 Identifies the first event to trace 





The TRCEVENTCTLOR can be accessed through the internal memory-mapped interface and the 
external debug interface, offset 0x020. 


13.7.4 Trace Event Control 1 Register 


The TRCEVENTCTLIR characteristics are: 


Purpose 
Controls the behavior of the events that TRCEVENTCTLOR selects. 
Usage constraints 
Only accepts writes when the trace unit is disabled. 
Configurations 
Available in all configurations. 
Attributes 
A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCEVENTCTLIR bit assignments. 


31 12 11 10 8 7 5 4 3 0 
ATB J 


Figure 13-5 TRCEVENTCL1R bit assignments 
The following table shows the TRCEVENTCTLIR bit assignments. 


Table 13-7 TRCEVENTCL1R bit assignments 





Bits Name Function 





[31:12] - Reserved, RESO. 





[11] ATB ATB trigger enable. This value is: 
0 ATB trigger is disabled. 
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Table 13-7 TRCEVENTCL1R bit assignments (continued) 





Bits Name Function 





[10:4] - Reserved, RESO. 





[3:0] INSTEN Instruction event enable field. Each bit represents an event, n=0-3. If event n occurs when INSTEN[n] is: 


0 The trace unit does not generate an event element. 


1 The trace unit generates an event element for event n, in the instruction trace stream. 





The TRCEVENTCTLIR can be accessed through the internal memory-mapped interface and the 
external debug interface, offset 0x024. 


13.7.5 Trace Synchronization Period Register 


The TRCSYNCPR characteristics are: 


Purpose 

Controls how often periodic trace synchronization requests occur. 
Usage constraints 

Only accepts writes when the trace unit is disabled. 


This register must be programmed. 


Configurations 

Available in all configurations. 
Attributes 

A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCSYNCPR bit assignments. 
31 5 4 0 


Figure 13-6 TRCSYNCPR bit assignments 
The following table shows the TRCSYNCPR bit assignments. 
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Table 13-8 TRCSYNCPR bit assignments 





Bits Name Function 





[31:5] - Reserved, RESO. 





[4:0] Period Controls how many bytes of trace, the sum of instruction and data, that a trace unit can generate before a periodic trace 


synchronization request occurs. 


When @b00@9, periodic trace synchronization requests are disabled. This setting does not disable other types of trace 


synchronization request. 


The number of bytes is always a power of two and the permitted values are: 


0be1000 
0be1001 
0be1010 


0b10100 


Periodic trace synchronization request occurs after 2°, or 256 bytes of trace. 
Periodic trace synchronization request occurs after 2°, or 512 bytes of trace. 


Periodic trace synchronization request occurs after 2!°, or 1024 bytes of trace. 


Periodic trace synchronization request occurs after 27°, or 1048576 bytes of trace. 





The TRCSYNCPR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x034. 


13.7.6 Trace Cycle Count Control Register 


The TRCCCCTLR characteristics are: 


Purpose 
Sets the threshold value for cycle counting. 
Usage constraints 
Only accepts writes when the trace unit is disabled. 


This register must be programmed if TRCCONFIGR.CCL is set to 1. 


Configurations 

Available in all configurations. 
Attributes 

A 32-bit RW trace register. 


See 13.6 Register summary on page 13-464. 
The following figure shows the TRCCCCTLR bit assignments. 


31 12 11 0 


Figure 13-7 TRCCCCTLR bit assignments 
The following table shows the TRCCCCTLR bit assignments. 


Table 13-9 TRCCCCTLR bit assignments 





Bits Name Function 





[31:12] - Reserved, RESO. 





[11:0] Threshold Sets the threshold value for instruction trace cycle counting. 
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The TRCCCCTLR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x038. 


Related information 
13.7.1 Trace Configuration Register on page 13-468. 


13.7.7 Trace ID Register 


The TRCTRACEIDR characteristics are: 


Purpose 

Sets the trace ID for instruction trace. 
Usage constraints 

Only accepts writes when the trace unit is disabled. 
Configurations 

Available in all configurations. 


The TRACEID field width is set by TRCIDR5.TRACEIDSIZE. 


Attributes 
A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCTRACEIDR bit assignments. 
31 7 6 0 


Figure 13-8 TRCTRACEIDR bit assignments 
The following table shows the TRCTRACEIDR bit assignments. 


Table 13-10 TRCTRACEIDR bit assignments 


Bits Name Function 





[31:7] - Reserved, RESO. 





[6:0] TRACEID Trace ID field. Sets the trace ID value for instruction trace. The width of this field is 7 bits. 





The TRCTRACEIDR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x049. 


Related information 
13.7.22 Trace ID Register 5 on page 13-489. 


13.7.8 Viewlnst Main Control Register 


The TRCVICTLR characteristics are: 


Purpose 
Controls instruction trace filtering. 
Usage constraints 
e Only accepts writes when the trace unit is disabled. 
e Only returns stable data when TRCSTATR.PMSTABLE is set to 1. 
e Must be programmed to set the value of the SSSTATUS bit, that sets the state of the start and 
stop logic. 
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Configurations 

Available in all configurations. 
Attributes 

A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCVICTLR bit assignments. 


31 24 23 20 19 16 15 121110 9 8 7 0 


L EXLEVEL_S L Reserved 
EXLEVEL_NS SSSTATUS 


TRCRESET 
TRCERR 


Figure 13-9 TRCVICTLR bit assignments 
The following table shows the TRCVICTLR bit assignments. 


Table 13-11 TRCVICTLR bit assignments 





Bits Name Function 





[31:24] - Reserved, RESO. 





[23:20] EXLEVEL_NS Each bit controls whether instruction tracing in Non-secure state is enabled for the corresponding Exception 
level. The bit to Exception level mapping is: 


Bit[20] Exception level 0. 
Bit[21] Exception level 1. 
Bit[22] Exception level 2. 
Bit[23] RESO. 


For example, the value @b@111 enables instruction tracing in Non-secure state for ELO, EL1, and EL2. 





[19:16] EXLEVEL_S Each bit controls whether instruction tracing in Secure state is enabled for the corresponding Exception 
level. The bit to Exception level mapping is: 


Bit[16] Exception level 0. 
Bit[17] Exception level 1. 
Bit[18] RESO. 

Bit[19] Exception level 3. 


For example, the value @b1011 enables instruction tracing in Secure state for EL0, EL1, and EL3. 





[15:12] - Reserved, RESO. 





[11] TRCERR Controls whether a trace unit must trace a System Error exception: 


0 The trace unit does not trace a System Error exception unless it traces the exception or instruction 
immediately prior to the System Error exception. 


1 The trace unit always traces a System Error exception. 





[10] TRCRESET Controls whether a trace unit must trace a reset exception: 


0 The trace unit does not trace a reset exception unless it traces the exception or instruction immediately 
prior to the reset exception. 


1 The trace unit always traces a reset exception. 
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Table 13-11 TRCVICTLR bit assignments (continued) 





Bits Name 


Function 





[9] SSSTATUS Returns the status of the start and stop logic. The possible values are: 


0 The start and stop logic is in the stopped state. 
1 The start and stop logic is in the started state. 


The bit only returns stable data when TRCSTATR.PMSTABLE is setto 1. 


Before software enables the trace unit and TRCPRGCTLR.EN is set to 1, it must write to this bit to set the 
initial state of the start and stop logic. If the start and stop logic is not used then set this bit to 1. ARM 
recommends that the value of this bit is set before each trace run begins. 





[8] - 


Reserved, RESO. 





[7:0] Event 


Event selector. 





The TRCVICTLR can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x080. 


13.7.9 External Input Select Register 


The TRCEXTINSELR characteristics are: 


Purpose 
Use this to set, or read, which external inputs are resources to the trace unit. 
Usage constraints 
Only accepts writes when the trace unit is disabled. 
Configurations 
The TRCIDR5.NUMEXTINSEL field controls how many input select resources are supported. 


The TRCIDRS.NUMEXTIN field controls how many inputs, from a maximum of 256, are 
supported. 


Attributes 
A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCEXTINSELR bit assignments. 


31 24 23 16 15 8 7 0 


SEL3 SEL2 SEL1 SELO 


Figure 13-10 TRCEXTINSELR bit assignments 
The following table shows the TRCEXTINSELR bit assignments. 


Table 13-12 TRCEXTINSELR bit assignments 





Bits 


Name Function 





[31:24] SEL3 A binary value that selects which external input is a resource for the trace unit. Bit[31] is reserved, RESO. 





[23:16] SEL2 A binary value that selects which external input is a resource for the trace unit. Bit[23] is reserved, RESO. 





[15:8] SELI A binary value that selects which external input is a resource for the trace unit. Bit[15] is reserved, RESO. 





[7:0] 


SELO A binary value that selects which external input is a resource for the trace unit. Bit[7] is reserved, RESO. 
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The TRCEXTINSELR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x120. 


13.7.10 ID Register 8 


The TRCIDR8 characteristics are: 


Purpose 
Returns the maximum speculation depth of the instruction trace stream. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR8 bit assignments. 


31 0 


MAXSPEC 


Figure 13-11 TRCIDR8 bit assignments 
The following table shows the TRCIDR8 bit assignments. 


Table 13-13 TRCIDR8 bit assignments 


Bits Name Function 





[31:0] MAXSPEC The maximum number of PO elements in the trace stream that can be speculative at any time: 


0 Maximum speculation depth of the instruction trace stream. 





The TRCIDR8 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x180. 


13.7.11 ID Register 9 


The TRCIDR9 characteristics are: 


Purpose 
Returns the number of PO right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR9 bit assignments. 


31 0 


NUMPOKEY 


Figure 13-12 TRCID9 bit assignments 
The following table shows the TRCIDR9 bit assignments. 
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Table 13-14 TRCID9 bit assignments 





Bits Name Function 





[31:0] NUMPOKEY The number of PO right-hand keys that the trace unit can use: 


0 The trace unit uses no PO right-hand keys. 





The TRCIDR9 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x184. 


13.7.12 ID Register 10 


The TRCIDR10 characteristics are: 


Purpose 
Returns the number of P1 right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR10 bit assignments. 


31 0 


NUMP1KEY 


Figure 13-13 TRCIDR10 bit assignments 
The following table shows the TRCIDR10 bit assignments. 


Table 13-15 TRCID10 bit assignments 





Bits Name Function 





[31:0] NUMPIKEY The number of P1 right-hand keys that the trace unit can use. 


0 The trace unit uses no P1 right-hand keys. 





The TRCIDR1O can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x188. 


13.7.13 ID Register 11 


The TRCIDR11 characteristics are: 


Purpose 
Returns the number of special P1 right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 
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The following figure shows the TRCIDR11 bit assignments. 


31 0 


NUMP1SPC 


Figure 13-14 TRCIDR11 bit assignments 
The following table shows the TRCIDR11 bit assignments. 


Table 13-16 TRCID11 bit assignments 


Bits Name Function 





[31:0] NUMPISPC The number of special P1 right-hand keys that the trace unit can use: 


0 The trace unit uses no special P1 right-hand keys. 





The TRCIDRI11 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x18C. 


13.7.14 ID Register 12 


The TRCIDR12 characteristics are: 
Purpose 
Returns the number of conditional instruction right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR12 bit assignments. 


31 0 


NUMCONDKEY 


Figure 13-15 TRCIDR12 bit assignments 
The following table shows the TRCIDR12 bit assignments. 


Table 13-17 TRCID12 bit assignments 





Bits Name Function 


[31:0] NUMCONDKEY The number of conditional instruction right-hand keys that the trace unit can use, including normal and 
special keys: 


0 ‘The trace unit uses no conditional instruction right-hand keys. 





The TRCIDR12 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x190. 
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13.7.15 ID Register 13 


The TRCIDR13 characteristics are: 


Purpose 
Returns the number of special conditional instruction right-hand keys that the trace unit can use. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR13 bit assignments. 


31 0 


NUMCONDSPC 


Figure 13-16 TRCIDR13 bit assignments 
The following table shows the TRCIDR13 bit assignments. 


Table 13-18 TRCID13 bit assignments 


Bits Name Function 





[31:0] NUMCONDSPC The number of special conditional instruction right-hand keys that the trace unit can use, including normal 
and special keys: 


0 The trace unit uses no special conditional instruction right-hand keys. 





The TRCIDR13 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset 0x194. 


13.7.16 Implementation Defined Register 0 


The TRCIMSPECO characteristics are: 


Purpose 
TRCIMSPEC0 is partially implemented for the future implementation of up to eight 
IMPLEMENTATION DEFINED registers so that a debugger can implement a general mechanism for 
detecting the IMPLEMENTATION DEFINED registers. This register must be implemented. 

Usage constraints 
There are no usage constraints. 

Configurations 
Available in all configurations. 

Attributes 
A 32-bit RW trace register. This register is reset by a trace unit reset. 


See 73.6 Register summary on page 13-464>. 
The following figure shows the TRCIMSPEC0 bit assignments. 
31 8 7 4 3 0 


Figure 13-17 TRCIMSPECO bit assignments 
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The following table shows the TRCIMSPECO bit assignments. 


Table 13-19 TRCIMSPECO bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO. 
[7:4] EN EN is RESO when the SUPPORT field is @b@000. 





[3:0] SUPPORT Indicates whether the implementation supports IMPLEMENTATION DEFINED features. This value is: 


@beeee No IMPLEMENTATION DEFINED features are supported. 





The TRCIMSPECO can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x1C8. 


13.7.17 Trace ID Register 0 


The TRCIDRO characteristics are: 


Purpose 
Returns the tracing capabilities of the trace unit. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDRO bit assignments. 
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Figure 13-18 TRCIDRO bit assignments 
The following table shows the TRCIDRO bit assignments. 


Table 13-20 TRCIDRO bit assignments 


Bits Name Function 





[31:30] - Reserved, RESO. 





[29] COMMOPT Commit mode field. This value is: 














1 Commit mode 1. 
[28:24] TSSIZE Global timestamp size field. This value is: 
6be1000 Implementation supports a maximum global timestamp of 64 bits. 
[23:17] - Reserved, RESO. 
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Table 13-20 TRCIDRO bit assignments (continued) 





Bits Name 


Function 





[16:15] QSUPP 


Q element support field. This value is: 


@bee Q element support is not implemented. TRCCONFIGR is RESO. 





[14]  QFILT 


QFILT is RESO when QSUPP is @b@@. 





[13:12] CONDTYPE 


CONDTYPE is RESO when TRCCOND is @b@. 





[11:10] NUMEVENT 


Number of events field. Indicates how many events the trace unit supports. This value is: 


@b11 The trace unit supports 4 events. 





[9] RETSTACK 


Return stack bit. Indicates whether the implementation supports a return stack. This value is: 


1 Return stack is implemented. TRCCONFIGR.RS is supported. 





[8] : 


Reserved, RESO. 





[7] TRCCCI 


Cycle counting instruction bit. Indicates whether the trace unit supports cycle counting for instructions. This 
value is: 


1 Cycle counting in the instruction trace is implemented, therefore: 
e TRCCONFIGR.CCI is supported. 
e TRCCCTLR is supported. 





[6] TRCCOND 


Conditional instruction tracing support bit. Indicates whether the trace unit supports conditional instruction 
tracing. This value is: 


0 Conditional instruction tracing is not supported. 





[5] TRCBB 


Branch broadcast tracing support bit. Indicates whether the trace unit supports branch broadcast tracing. This 
value is: 


1 Branch broadcast tracing is supported, therefore: 


e TRCCONFIGR.CCI is supported. 
e TRCBBCTLR is supported. 





[4:3] TRCDATA 


Conditional tracing field. This value is: 








@bee Data tracing is not supported. 
[2:1] INSTPO PO tracing support field. This value is: 

@bee Tracing of load and store instructions as PO elements is not supported. 
[0] - Reserved, RES1. 





The TRCIDRO can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x1E@. 


13.7.18 Trace ID Register 1 


The TRCIDR1 characteristics are: 


Purpose 


Returns the base architecture of the trace unit. 


Usage constraints 


There are no usage constraints. 
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Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR1 bit assignments. 


31 24 23 16 15 12 11 8 


7 4 3 0 
ee 
TRCARCHMAJ 
TRCARCHMIN 
Figure 13-19 TRCIDR1 bit assignments 
The following table shows the TRCIDR1 bit assignments. 


Table 13-21 TRCIDR1 bit assignments 














Bits Name Function 

[31:24] Designer Indicates which company designed the trace unit. The value is: 
0x41 ARM 

[23:16] - Reserved, RESO. 

[15:12] - Reserved, RES1. 





[11:8] _TRCARCHMAJ Indicates the major version number of the trace unit architecture. The value is: 


0x4 Indicates ETMv4. 


All other values are reserved. 





[7:4] | TRCARCHMIN Identifies the minor version number of the trace unit architecture. The value is: 


Ox® Identifies the minor version number of the trace unit architecture. 





[3:0] Revision Identifies the revision of: 


¢ The trace registers. 
« The OS Lock registers. 


0x1 Revision value. 





The TRCIDRI can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x1E4. 


13.7.19 Trace ID Register 2 


The TRCIDR2 characteristics are: 


Purpose 
Returns the maximum size of the following parameters in the trace unit: 
e Data value. 
e Data address. 
e VMID. 
* Context ID. 
e Instruction address. 
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Usage constraints 

There are no usage constraints. 
Configurations 

Available in all configurations. 
Attributes 

See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR2 bit assignments. 
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Figure 13-20 TRCIDR2 bit assignments 
The following table shows the TRCIDR2 bit assignments. 


Table 13-22 TRCIDR2 bit assignments 


Function 





[31:29] - 


Reserved, RESO. 





[28:25] CCSIZE 


Indicates the size of the cycle counter in bits minus 12. This value is: 


0x0 The cycle counter is 12 bits in length. 





[24:20] DVSIZE 


Indicates the data value size in bytes. This value is: 


Əxð Data value tracing is not supported. TRCIDRO.TRCDATA must be @b@0. 





[19:15] DASIZE 


Indicates the data address size in bytes. This value is: 


@x@ Data address tracing is not supported. TRCIDRO.TRCDATA must be @be0. 





[14:10] VMIDSIZE Indicates the VMID size. This value is: 


@x1 Maximum of 8-bit VMID size, therefore TRCCONFIGR.VMID is supported. 





[9:5]  CIDSIZE 


Indicates the Context ID size. This value is: 


@x4 Maximum of 32-bit CID size, therefore TRCCONFIGR.CID is supported. 





[4:0]  IASIZE 


Indicates the instruction address size in bytes. This value is: 


0x8 Maximum of 64-bit address size. 





The TRCIDR2 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x1E8. 


13.7.20 Trace ID Register 3 


The TRCIDR3 characteristics are: 


Purpose Indicates: 
e Whether TRCVICTLR is supported. 
¢ The number of cores available for tracing. 
e Ifan Exception level supports instruction tracing. 
¢ The minimum threshold value for instruction trace cycle counting. 
e Whether the synchronization period is fixed. 
e Whether TRCSTALLCTLR is supported and if so whether it supports trace 
overflow prevention and supports stall control of the core. 
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Usage constraints There are no usage constraints. 
Configurations Available in all configurations. 


Attributes See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR3 bit assignments. 
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Figure 13-21 TRCIDR3 bit assignments 
The following table shows the TRCIDR3 bit assignments. 


Table 13-23 TRCIDR3 bit assignments 





Bits Name Function 





[31] NOOVERFLOW Indicates whether TRCSTALLCTLR.NOOVERFLOW is supported. This value is: 
0 TRCSTALLCTLR.NOOVERFLOW is not supported. STALLCTL is 0. 








[30:28] NUMPROC Indicates the number of cores available for tracing. This value is: 
ebeee The trace unit can trace one core. 
[27] SYSTALL Indicates whether stall control is supported. This value is: 


0 The system does not support stall control of the core. 





[26] STALLCTL Indicates whether TRCSTALLCTLR is supported. This value is: 
0 TRCSTALLCTLR is not supported. 








[25] SYNCPR Indicates whether there is a fixed synchronization period. This value is: 


0 TRCSYNCPR is read-write so software can change the synchronization period. 








[24] TRCERR Indicates whether TRCVICTLR.TRCERR is supported. This value is: 
1 TRCVICTLR.TRCERR is supported. 
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Table 13-23 TRCIDR3 bit assignments (continued) 





Bits Name Function 





[23:20] EXLEVEL NS Each bit controls whether instruction tracing in Non-secure state is supported for the corresponding 
Exception level. The value is: 


@b@111 Instruction tracing in Non-secure state is supported for ELO, EL1, and EL2. 





Note 
The bit to Exception level mapping is: 


Bit[20] Exception level 0. 
Bit[21] Exception level 1. 
Bit[22] Exception level 2. 
Bit[23] Always RESO. 








[19:16] EXLEVEL S Each bit controls whether instruction tracing in Secure state is supported for the corresponding Exception 
level. The value is: 


@b1011 Instruction tracing in Secure state is supported for ELO, EL1, and EL3. 





Note 
The bit to Exception level mapping is: 











Bit[16] Exception level 0. 
Bit[15] Exception level 1. 
Bit[14] Always RESO. 
Bit[13] Exception level 3. 
[15:12] - Reserved, RESO. 
[11:0] CCITMIN The minimum value that can be programmed in TRCCCCTLR.THRESHOLD. This value is: 
0x004 Minimum value for cycle counting in the instruction trace. 





The TRCIDR3 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x1EC. 


13.7.21 Trace ID Register 4 


The TRCIDR4 characteristics are: 


Purpose Returns how many resources the trace unit supports. 
Usage constraints There are no usage constraints. 

Configurations Available in all configurations. 

Attributes See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDR4 bit assignments. 
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Figure 13-22 TRCIDR4 bit assignments 


The following table shows the TRCIDR4 bit assignments. 


Table 13-24 TRCIDR4 bit assignments 












































Bits Name Function 

[31:28] NUMVMIDC Indicates the number of VMID comparators available for tracing. This value is: 
0x1 One VMID comparator is available. 

[27:24] NUMCIDC Indicates the number of CID comparators available for tracing. This value is: 
0x1 One Context ID comparator is available. 

[23:20] NUMSSCC Indicates the number of single-shot comparator controls available for tracing. This value is: 
0x1 One single-shot comparator control is available. 

[19:16] NUMRSPAIR Indicates the number of resource selection pairs available for tracing. This value is: 
0x7 Eight resource selection pairs are available. 

[15:12] NUMPC Indicates the number of processor comparator inputs available for tracing. This value is: 
0xð No processor comparator inputs are available. 

[11:9] - Reserved, RESO. 

[8] SUPPDAC Indicates whether the implementation supports data address comparisons: This value is: 
0 Data address comparisons are not supported. 

[7:4] NUMDVC Indicates the number of data value comparators available for tracing. This value is: 
0xð No data value comparators are available. 

[3:0] | NUMRSPAIRS Indicates the number of address comparator pairs available for tracing. This value is: 
0x4 Four address comparator pairs are available. 
The TRCIDR4 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x1F@. 
13.7.22 Trace ID Register 5 


The TRCIDRS characteristics are: 


Purpose 


Returns how many resources the trace unit supports. 


Usage constraints 


There are no usage constraints. 
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Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCIDRS bit assignments. 
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Figure 13-23 TRCIDRS5 bit assignments 
The following table shows the TRCIDRS bit assignments. 


Table 13-25 TRCIDRS bit assignments 





Bits Name Function 





[31] REDFUNCNTR Indicates whether the reduced function counter is implemented. This value is: 


0 Reduced function counter is not supported. 





[30:28] NUMCNTR Indicates the number of counters available for tracing. This value is: 


0b0190 Two counters are available. 





[27:25] NUMSEQSTATE Indicates the number of sequencer states implemented. This value is: 


b100 Four sequencer states are implemented. 





[24] - Reserved, RESO. 





[23] LPOVERRIDE Indicates whether low power state override is supported. This value is: 


0 Low power state override is not supported. 





[22] ATBTRIG Indicates whether ATB triggers are supported. This value is: 
1 ATB triggers are supported and the TRCEVENTCTL1R.ATBTRIG field is implemented. 





[21:16] TRACEIDSIZE Trace ID width. This value is: 


@x@7 A 7-bit trace ID width is supported. This defines the width of the TRCTRACEIDR.TRACEID 
field. 





Note 
The CoreSight ATB requires a 7-bit trace ID width. 








[15:12] - Reserved, RESO. 
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Table 13-25 TRCIDRS5 bit assignments (continued) 





Bits Name Function 





[11:9] NUMEXTINSEL Indicates the number of external input select resources are implemented. If NUMEXTINSEL is 0, 
NUMEXTIN must also be 0. This value is: 


0b100 Four external input select resources are implemented. 





[8:0] | NUMEXTIN Indicates the number of external inputs are implemented. This value is: 


0b001101110 110 external inputs are implemented. 





The TRCIDRS can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @x1F4. 


13.7.23 Resource Selection Control Registers 


The TRCRSCTLRn characteristics are: 
Purpose 
Controls the selection of the resources in the trace unit. 
Note 
The range of n for TRCRSCTLRn is 2 to 15. 








Usage constraints 
e Only accepts writes when the trace unit is disabled. 
e Ifsoftware selects an non-implemented resource then constrained UNPREDICTABLE behavior of 
the resource selector occurs. The resource selector might activate unexpectedly or might not 
activate. Reads of the TRCRSCTLRn might return UNKNOWN. 


Configurations 
Resource selectors are implemented in pairs and there are eight pairs of TRCRSCTLR registers 
implemented, set by TRCIDR4.NUMRSPAIR. Each odd numbered resource selector is part of a 
pair with the even numbered resource selector that is numbered as one less than it. For example, 
resource selectors 2 and 3 form a pair. 


Resource selector pair 0 is always implemented and is reserved. Resource selector zero always 
returns FALSE, and resource selector one always returns TRUE. 


Attributes 
A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCRSCTLRn bit assignments. 
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Figure 13-24 TRCSCTLR 
The following table shows the TRCRSCTLRn bit assignments. 
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Table 13-26 TRCSCTLRn bit assignments 





Bits Name 


Function 





[31:22] - 


Reserved, RESO. 





[21] PAIRINV Controls whether the combined result from a resource pair is inverted when n is 2, 4, 6, 8, 10, 12, or 14. The 


possible values are: 
0 The combined result is not inverted. 


1 The combined result is inverted. 


PAIRINV is RESO when n is 3, 5,7, 9, 11, 13, or 15. 








[20] INV Controls whether the resource, that GROUP and SELECT selects, is inverted. The possible values are: 
0 The selected resource is not inverted. 
1 The selected resource is inverted. 

[19] - Reserved, RESO. 





[18:16] Group 


Selects a group of resources. See the ARM® Embedded Trace Macrocell Architecture Specification, ETMv4 for 
more information. 





[15:8] - 


Reserved, RESO. 





[7:0] Select 


Selects one or more resources from the group that the GROUP field selects. Each bit represents a resource from 
the selected group. See the ARM® Embedded Trace Macrocell Architecture Specification, ETMv4 for more 
information. 





The TRCRSCTLRn can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x2@8-023C. 


13.7.24 Address Comparator Access Type Registers 


The TRCACATR» characteristics are: 


Purpose 
Defines the type of access for the corresponding TRCACVRn Register. This register configures 
the parameters of the address comparator for: 
e Context type. 
e Exception levels. 
¢ Alignment. 
e Masking. 
e Behavior when it is one half of an address range comparator. 





Note 
The range of n for TRCACATRn is 0 to 7. 
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Usage constraints 
e Only accepts writes when the trace unit is disabled. 
e Constrained UNPREDICTABLE behavior of a comparator resource occurs if: 
— TYPE is 0 and DATAMATCH is @b@1, @b18, or @b11. 
— DATAMATCH is @b@1, 0b10, or @b11 and software programs an address comparator to 
control View Data. 


In these scenarios, the comparator might match unexpectedly or might not match. 
e If software uses two single address comparators as an address range comparator then it must 
program the corresponding TRCACATRs with identical values in the following fields: 
— TYPE. 
— CONTEXTTYPE. 
— CONTEXT. 
— EXLEVEL S. 
— EXLEVEL NS. 


Configurations 

The number TRCACATRs is eight and is set by twice the size of TRCIDR4.NUMACPAIRS. 
Attributes 

A 64-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCACATRn bit assignments. 
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Figure 13-25 TRCACATR 







Reserved 





The following table shows the TRCACATRn bit assignments. 


Table 13-27 TRCACATRnh bit assignments 





Bits Name Function 





[63:16] - Reserved, RESO. 





[15:12] EXLEVEL NS Each bit controls whether a comparison can occur in Non-secure state for the corresponding Exception level. 
The possible values are: 


0 The trace unit can perform a comparison, in Non-secure state, for Exception level n. 


1 The trace unit does not perform a comparison, in Non-secure state, for Exception level n. 





Note 
The bit to Exception level mapping is: 











Bit[12] Exception level 0. 
Bit[13] Exception level 1. 
Bit[14] Exception level 2. 
Bit[15] Always RESO. 
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Table 13-27 TRCACATRh bit assignments (continued) 





Bits Name Function 





[11:8] EXLEVEL S Each bit controls whether a comparison can occur in Secure state for the corresponding Exception level. The 
possible values are: 


0 The trace unit can perform a comparison, in Secure state, for Exception level n. 


1 The trace unit does not perform a comparison, in Secure state, for Exception level n. 





Note 
The bit to Exception level mapping is: 








Bit[8] Exception level 0. 

Bit[9] Exception level 1. 

Bit[10] Always RESO. 

Bit[11] Exception level 3. 
[7:4] - Reserved, RESO. 





[3:2] Context type Controls whether the trace unit performs a Context ID comparison, a VMID comparison, or both 
comparisons: 


@bee The trace unit does not perform a Context ID comparison. 

@b@1 The trace unit performs a Context ID comparison using the Context ID comparator that the 
CONTEXT field specifies, and signals a match if both the Context ID comparator matches and the 
address comparator match. 

b10 The trace unit performs a VMID comparison using the VMID comparator that the CONTEXT field 
specifies, and signals a match if both the VMID comparator and the address comparator match. 

@b11 The trace unit performs a Context ID comparison and a VMID comparison using the comparators 
that the CONTEXT field specifies, and signals a match if the Context ID comparator matches, the 
VMID comparator matches, and the address comparator matches. 





[1:0] Type Type is RESO when TRCIDR4.SUPPDAC is @b®. 





The TRCACATR can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @x480-0x4B8. 


13.7.25 Context ID Comparator Value Register 0 


The TRCCIDCVR0O characteristics are: 


Purpose 

Contains a Context ID value. 
Usage constraints 

Only accepts writes when the trace unit is disabled. 
Configurations 

There is one TRCCIDCVR register, set by TRCIDR4.NUMCIDC. 
Attributes 

A 64-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCCIDCVR0O bit assignments. 
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Figure 13-26 TRCCIDCVRO bit assignments 
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The following table shows the TRCCIDCVR0O bit assignments. 


Table 13-28 TRCCIDCVRO bit assignments 


Bits Name Function 





[63:32] - Reserved, RESO. 





[31:0] Context ID Value The context ID value is 32 bits, set by TRCIDR2.CIDSIZE. 





The TRCCIDCVRO can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x600. 


13.7.26 |VMID Comparator Value Register 0 


The TRCVMIDCVR0O characteristics are: 


Purpose 
Contains a VMID value. 
Usage constraints 
Only accepts writes when the trace unit is disabled. 
Configurations 
There is one TRCVMIDCVR register, set by TRCIDR4.NUMVMIDC. 
Attributes 
A 64-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCVMIDCVR0O bit assignments. 
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Figure 13-27 TRCVMIDCVRO bit assignments 







Reserved 





The following table shows the TRCVMIDCVR0O bit assignments. 


Table 13-29 TRCVMIDCVRO bit assignments 





Bits Name Function 





[63:8] - Reserved, RESO 





[7:0] VMID Value The VMID value is 64 bits, set by TRCIDR2. VMIDSIZE 





The TRCVMIDCVRO can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x649. 
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13.7.27 Context ID Comparator Control Register 0 


The TRCCIDCCTLRO characteristics are: 


Purpose 

Contains Context ID mask values for the TRCCIDCVR0O register. 
Usage constraints 

e Only accepts writes when the trace unit is disabled. 


e Ifsoftware sets a mask bit to 1 then it must program the relevant byte in TRCCIDCVRn to 
0x00. 


Configurations 

There is one Context ID comparator, set by TRCIDR4.NUMCIDC. 
Attributes 

A 32-bit RW trace register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCCIDCCTLRO bit assignments. 
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Figure 13-28 TRCCIDCCTLRO bit assignments 
The following table shows the TRCCIDCCTLRO bit assignments. 


Table 13-30 TRCCIDCCTLRO bit assignments 





Bits Name Function 





[31:4] - Reserved, RESO. 





[3:0] COMPO Controls the mask value that the trace unit applies to TRCCIDCVRO. Each bit in this field corresponds to a byte in 
TRCCIDCVRO. When a bit is: 


0 The trace unit includes the relevant byte in TRCCIDCVRO when it performs the Context ID comparison. 
1 The trace unit ignores the relevant byte in TRCCIDCVRO when it performs the Context ID comparison. 





The TRCCIDCCTLR0O can be accessed through the internal memory-mapped interface and the external 
debug interface, offset 0x680. 


13.7.28 Trace Integration Miscellaneous Outputs Register 


The TRCITMISCOUT characteristics are: 


Purpose 
Controls signal outputs when TRCITCTRL.IME is set. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCITMISCOUT bit assignments. 
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Figure 13-29 TRCITMISCOUT bit assignments 
The following table shows the TRCITMISCOUT bit assignments. 


Table 13-31 TRCITMISCOUT bit assignments 





Bits Name Function 





[31:12] - Reserved, RESO. 





[11:8] ETMEXTOUT[3:0] Drives the EXTOUT[3:0] outputs. 





[7:0] - Reserved, RESO. 





The TRCITMISCOUT can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xEDC. 


Related information 
13.7.34 Trace Integration Mode Control register on page 13-501. 


13.7.29 Trace Integration Miscellaneous Input Register 


The TRCITMISCIN characteristics are: 


Purpose 
Enables the values of signal inputs to be read when TRCITCTRL.IME is set. 


Usage constraints 

There are no usage constraints. 
Configurations 

Available in all configurations. 
Attributes 

See 73.6 Register summary on page 13-464. 


The following figure shows the TRCITMISCIN bit assignments. 
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Figure 13-30 TRCITMISCIN bit assignments 
The following table shows the TRCITMISCIN bit assignments. 


Table 13-32 TRCITMISCIN bit assignments 





Bits Name Function 


[31:4] - Reserved, RESO. 





[3:0] ETMEXTIN[3:0] Returns the value of the ETMEXTIN[3:0] inputs. 
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The TRCITMISCIN can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xEE@. 


Related information 
13.7.34 Trace Integration Mode Control register on page 13-501. 


13.7.30 Trace Integration Test ATB Data Register 0 


The TRCITATBDATAO characteristics are: 


Purpose 
Controls signal outputs when TRCITCTRL.IME is set. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCITATBDATAO bit assignments. 
31 6 43210 


ATDATAM[31] — 
ATDATAM[23] 
ATDATAM[15] 


ATDATAMI7] 
ATDATAM(0] 


Figure 13-31 TRCITATBDATAO bit assignments 
The following table shows the TRCITATBDATAO bit assignments. 


Table 13-33 TRCITATBDATAO bit assignments 





Bits Name Function 





[31:5] - Reserved, RESO. 





[4] | ATDATAM[31] Drives the ATDATAM[31] output 





[3] ATDATAM[23] Drives the ATDATAM[23] output 





[2] ATDATAM[15] Drives the ATDATAM[15] output 





[1] | ATDATAM[7] Drives the ATDATAM[7] output 














[0] | ATDATAM[0] Drives the ATDATAM[0] output 





The TRCITATBDATAO can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xEEC. 


Related information 
13.7.34 Trace Integration Mode Control register on page 13-501. 


13.7.31 Trace Integration Test ATB Control Register 2 


The TRCITATBCTR2 characteristics are: 
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Purpose 
Enables the values of signal inputs to be read when bit[0] of the Integration Mode Control 
Register is set. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCITATBCTR2 bit assignments. 


31 2 1 


emt O 
AFVALIDM _ 
ATREADYM 


Figure 13-32 TRCITATBCTR2 bit assignments 


le 


The following table shows the TRCITATBCTR2 bit assignments. 


Table 13-34 TRCITATBCTR2 bit assignments 





Bits Name Function 





[31:2] - Reserved, RESO. 





[1] AFVALIDM Returns the value of AFVALIDM input 





[0] ATREADYM Returns the value of ATREADYM input®?” 





The TRCITATBCTR2 can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xEF@. 


Related information 
13.7.34 Trace Integration Mode Control register on page 13-501. 


13.7.32 Trace Integration Test ATB Control Register 1 


The TRCITATBCTRI characteristics are: 


Purpose 
Controls the ATIDM[6:0] signals when TRCITCTRL.IME is set. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCITATBCTR1 bit assignments. 





€Z To sample ATREADYM correctly from the processor signals, ATVALIDM must be asserted. 
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31 7 6 0 


Figure 13-33 TRCITATBCTR1 bit assignments 


The following table shows the TRCITATBCTR1 bit assignments. 
Table 13-35 TRCITATBCTR1 bit assignments 


Bits Name Function 





[31:7] - Reserved, RESO. 





[6:0] ATIDM[6:0] Drives the ATIDM[6:0] outputs 





The TRCITATBCTR2 can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xEF4. 


Related information 
13.7.34 Trace Integration Mode Control register on page 13-501. 


13.7.33 Trace Integration Test ATB Control Register 0 


The TRCITATBCTRO characteristics are: 


Purpose 
Controls signal outputs when TRCITCTRL.IME is set. 
Usage constraints 
There are no usage constraints. 
Configurations 
Available in all configurations. 
Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCITATBCTR0O bit assignments. 


31 109 87 210 
ATBYTESM{[1:0] — AFREADYM-—! 
ATVALIDM 


Figure 13-34 TRCITATBCTRO bit assignments 


The following table shows the TRCITATBCTRO bit assignments. 
Table 13-36 TRCITATBCTRO bit assignments 





Bits Name Function 





[31:10] - Reserved, RESO 





[9:8] | ATBYTESM[1:0] Drives the ATBYTESM outputs 





[7:2] - Reserved, RESO 





[1] AFREADYM Drives the AFREADYM output 





[0] ATVALIDM Drives the ATVALIDM output 
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The TRCITATBCTRO can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xEF8. 


Related information 
13.7.34 Trace Integration Mode Control register on page 13-501. 


13.7.34 Trace Integration Mode Control register 


The TRCITCTRL characteristics are: 


Purpose 
Controls whether the trace unit is in integration mode. 
Usage constraints 
e Accessible only from the memory-mapped interface or from an external agent such as a 
debugger. 
e Ifthe IME bit changes from one to zero then ARM recommends that the trace unit is reset. 
Otherwise the trace unit might generate incorrect or corrupt trace and the trace unit resources 
might behave unexpectedly. 


Configurations 
Available in all configurations. 
Attributes 
A 32-bit RW management register. The register is reset to zero. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCITCTRL bit assignments. 


31 1 0 
em SOS 
IME al 


Figure 13-35 TRCITCTRL bit assignments 
The following table shows the TRCITCTRL bit assignments. 


Table 13-37 TRCITCTRL bit assignments 





Bits Name Function 


[31:1] - Reserved, RESO 





[0] IME Integration mode enable bit. The possible values are: 


0 = The trace unit is not in integration mode. 
1 The trace unit is in integration mode. This mode enables: 


« A debug agent to perform topology detection. 
e SoC test software to perform integration testing. 





The TRCITCTRL can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFee. 


13.7.35 Trace Device Affinity register 0 


The TRCDEVAFFO characteristics are: 
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Purpose 
The value is a read-only copy of MPIDR_EL1[31:0] as seen from EL3, unaffected by 
VMPIDR_EL2. 

Usage constraints 
Accessible only from the memory-mapped interface or from an external agent such as a 
debugger. 

Configurations 
Available in all configurations. 

Attributes 
A 32-bit RO management register. 


For the Cortex-A72 processor, MPIDR_EL1[31:0] is architecturally mapped to the AArch32 
register MPIDR. 


See 73.6 Register summary on page 13-464. 


The TRCDEVAFFO0 can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xFA8. 


Related information 
4.5.3 Multiprocessor Affinity Register on page 4-240. 


13.7.36 Trace Device Affinity register 1 


The TRCDEVAFF!1 characteristics are: 


Purpose 
The value is a read-only copy of MPIDR_EL1[63:32] as seen from EL3, unaffected by 
VMPIDR _EL2. 

Usage constraints 
Accessible only from the memory-mapped interface or from an external agent such as a 
debugger. 

Configurations 
Available in all configurations. 

Attributes 
A 32-bit RO management register. 


For the Cortex-A72 processor, MPIDR_EL1[63:32] is REso. 
See 73.6 Register summary on page 13-464. 


The TRCDEVAFF1 can be accessed through the internal memory-mapped interface and the external 
debug interface, offset @xFAC. 


13.7.37 Trace Peripheral Identification Registers 


The Trace Peripheral Identification Registers provide standard information required for all CoreSight 
components. There is a set of eight registers, listed in register number order in the following table. 


Table 13-38 Summary of the Trace Peripheral ID Registers 





Register Value Offset 





TRCPIDR4 0x04 @xFDO 





TRCPIDR5 0x00 @xFD4 





TRCPIDR6 0x00 OxFD8 





TRCPIDR7 0x00 @xFDC 
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Table 13-38 Summary of the Trace Peripheral ID Registers (continued) 





Register Value Offset 





TRCPIDRO @x5A @xFEO 





TRCPIDRI @xB9 ©xFE4 





TRCPIDR2 @x®B OxFE8 





TRCPIDR3 0x00 @xFEC 





Only bits[7:0] of each Trace Peripheral ID Register are used, with bits[31:8] reserved. Together, the eight 
Trace Peripheral ID Registers define a single 64-bit Peripheral ID. 


The Peripheral ID registers are: 

¢ Trace Peripheral Identification Register 0 on page 13-503. 

¢ Trace Peripheral Identification Register I on page 13-504. 

¢ Trace Peripheral Identification Register 2 on page 13-504. 

¢ Trace Peripheral Identification Register 3 on page 13-505. 

¢ Trace Peripheral Identification Register 4 on page 13-506. 

e Trace Peripheral Identification Register 5-7 on page 13-506. 


Trace Peripheral Identification Register 0 
The TRCPIDRO characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

A 32-bit RO management register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCPIDRO bit assignments. 


31 8 7 0 


Figure 13-36 TRCPIDRO bit assignments 
The following table shows the TRCPIDRO bit assignments. 


Table 13-39 TRCPIDRO bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:0] Part 0 @x5A Least significant byte of the ETM part number. 





TRCPIDRO can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFEO. 
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Trace Peripheral Identification Register 1 
The TRCPIDR1 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

A 32-bit RO management register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCPIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 13-37 TRCPIDR1 bit assignments 
The following table shows the TRCPIDR1 bit assignments. 


Table 13-40 TRCPIDR1 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] DES_0 exp ARM Limited. This is the least significant nibble of JEP106 ID code. 





[3:0] Part_l x9 Most significant nibble of the ETM part number. 





TRCPIDRI can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFE4. 


Trace Peripheral Identification Register 2 
The TRCPIDR2 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

A 32-bit RO management register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCPIDR2 bit assignments. 
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31 8 7 432 0 
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Figure 13-38 TRCPIDR2 bit assignments 
The following table shows the TRCPIDR2 bit assignments. 


Table 13-41 TRCPIDR2 bit assignments 





Bits Name Function 











[31:8] - Reserved, RESO. 
[7:4] Revision øx1 Part major revision. 
[3] JEDEC @b1 RESI. Indicates a JEP106 identity code is used. 





[2:0] DES_1  @be11 ARM Limited. This is the most significant nibble of JEP106 ID code. 





TRCPIDR2 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFE8. 

Trace Peripheral Identification Register 3 

The TRCPIDR3 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

A 32-bit RO management register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCPIDR3 bit assignments. 
31 8 7 4 3 0 


Figure 13-39 TRCPIDR3 bit assignments 
The following table shows the TRCPIDR3 bit assignments. 


Table 13-42 TRCPIDR3 bit assignments 





Bits Name Function 

















[31:8] - Reserved, RESO. 
[7:4] REVAND ex@ Part minor revision. 
[3:0] CMOD 0x0 Customer modified. 
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TRCPIDR3 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFEC. 


Trace Peripheral Identification Register 4 


The TRCPIDR4 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

A 32-bit RO management register. 


See 73.6 Register summary on page 13-464. 
The following figure shows the TRCPIDR4 bit assignments. 
31 8 7 4 3 0 


Figure 13-40 TRCPIDR4 bit assignments 
The following table shows the TRCPIDR4 bit assignments. 


Table 13-43 TRCPIDR4 bit assignments 





Bits Name Function 





[31:8] - Reserved, RESO. 





[7:4] Size @x@ Size of the component. Log2 the number of 4KB pages from the start of the component to the end of the ETM 
component ID registers. 





[3:0] DES_2 @x4 ARM Limited. This is the least significant nibble of the JEP106 continuation code. 





TRCPIDR4 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFD@. 


Trace Peripheral Identification Register 5-7 
No information is held in the Peripheral ID5, Peripheral ID6 and Peripheral ID7 Registers. 


They are reserved for future use and are RESO. 


13.7.38 Trace Component Identification Registers 


There are four read-only Trace Component Identification Registers, Trace Component IDO to Trace 
Component ID3. The following table shows these registers. 
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Table 13-44 Summary of the ETM Component Identification Registers 





Register Value Offset 





TRCCIDRO ®x@D OxFFO@ 





TRCCIDRI1 0x90 OxFF4 





TRCCIDR2 0x05 OxFF8 





TRCCIDR3 @xB1 @xFFC 





The Trace Component Identification Registers identify ETM as a CoreSight component. 


The Trace Component ID registers are: 

¢ Trace Component Identification Register 0 on page 13-507. 
¢ Trace Component Identification Register 1 on page 13-507. 
¢ Trace Component Identification Register 2 on page 13-508. 
e Trace Component Identification Register 3 on page 13-509. 


Trace Component Identification Register 0 


The TRCCIDRO characteristics are: 


Purpose 
Provides information to identify a trace component. 


Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 
Available in all implementations. 


Attributes 
See 73.6 Register summary on page 13-464. 


The following figure shows the TRCCIDR0O bit assignments. 
31 8 7 0 


Figure 13-41 TRCCIDRO bit assignments 
The following table shows the TRCCIDRO bit assignments. 
Table 13-45 TRCCIDRO bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO. 
[7:0] PRMBL_0 @xep Preamble byte 0. 





TRCCIDRO can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFF@. 


Trace Component Identification Register 1 


The TRCCIDR1 characteristics are: 
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Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

See 73.6 Register summary on page 13-464. 


The following figure shows the TRCCIDR1 bit assignments. 
31 8 7 4 3 0 


Figure 13-42 TRCCIDR1 bit assignments 
The following table shows the TRCCIDR1 bit assignments. 


Table 13-46 TRCCIDR1 bit assignments 














Bits Name Function 

[31:8] - Reserved, RESO. 

[7:4] CLASS 0x9 Debug component. 
[3:0] PRMBL_ 1 gx@ Preamble. 





TRCCIDRI can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFF4. 

Trace Component Identification Register 2 

The TRCCIDR2 characteristics are: 


Purpose 
Provides information to identify a CTI component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

See 73.6 Register summary on page 13-464. 


The following figure shows the TRCCIDR2 bit assignments. 
31 8 7 0 


Figure 13-43 TRCCIDR2 bit assignments 
The following table shows the TRCCIDR2 bit assignments. 
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Table 13-47 TRCCIDR2 bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO. 
[7:0] PRMBL 2 9x@5 Preamble byte 2. 





TRCCIDR2 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFF8. 

Trace Component Identification Register 3 

The TRCCIDR3 characteristics are: 


Purpose 
Provides information to identify a trace component. 
Usage constraints 
e Only bits[7:0] are valid. 
e Accessible only from the memory-mapped interface or the external debugger interface. 


Configurations 

Available in all implementations. 
Attributes 

See 73.6 Register summary on page 13-464. 


The following figure shows the TRCCIDR3 bit assignments. 
31 8 7 0 


Figure 13-44 TRCCIDR3 bit assignments 
The following table shows the TRCCIDR3 bit assignments. 


Table 13-48 TRCCIDR3 bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO. 
[7:0] PRMBL 3 gxp1 Preamble byte 3. 





TRCCIDR3 can be accessed through the internal memory-mapped interface and the external debug 
interface, offset @xFFC. 
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13.8 Interaction with debug and the Performance Monitor Unit 
Describes the interaction with the Performance Monitor Unit and debug. 


This section contains the following subsections: 
¢ 13.8.1 Interaction with the Performance Monitor Unit on page 13-510. 
¢ 13.8.2 Effect of debug double lock on trace register access on page 13-510. 


13.8.1 Interaction with the Performance Monitor Unit 


The Cortex-A72 processor includes a Performance Monitor Unit (PMU) that enables events, such as 
cache misses and instructions executed, to be counted over a period of time. This section describes how 
the PMU and ETM function together. 


Use of PMU events by the ETM 


All PMU architectural events are available to the ETM through the extended input facility. See the ARM® 
Architectural Reference Manual ARMV8 for more information about PMU events. 


The ETM uses four extended external input selectors to access the PMU events. Each selector can 
independently select one of the PMU events, that are then active for the cycles where the relevant events 
occur. These selected events can then be accessed by any of the event registers within the ETM. 


Related information 
Chapter 11 Performance Monitor Unit on page 11-395. 


13.8.2 Effect of debug double lock on trace register access 


All trace register accesses through the memory-mapped and external debug interfaces behave as if the 
processor power domain is powered down when debug double lock is set. For more information on 
debug double lock, see the ARM® Architecture Reference Manual ARMVv8. 
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Advanced SIMD and Floating-point 


This chapter describes the Advanced SIMD and Floating-point features and registers in the Cortex-A72 
processor. 


It contains the following sections: 

e 14.1 About Advanced SIMD and Floating-point on page 14-512. 

¢ 14.2 Programmers model for Advanced SIMD and Floating-point on page 14-513. 
e 14.3 AArch64 register summary on page 14-514. 

¢ 14.4 AArch64 register descriptions on page 14-515. 

e 14.5 AArch32 register summary on page 14-524. 

e 14.6 AArch32 register descriptions on page 14-525. 
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14.1 About Advanced SIMD and Floating-point 


The Cortex-A72 processor supports the Advanced SIMD and Floating-point instructions in the A64, 
A32, and T32 instruction sets. 


The ARMv8-A architecture eliminates the concept of version numbers for Advanced SIMD and 
Floating-point in AArch64 state because the instructions are always implicitly present. 


This section contains the following subsections: 
e 14.1.1 Advanced SIMD support on page 14-512. 
e 14.1.2 Floating-point support on page 14-512. 


14.1.1 Advanced SIMD support 


The Cortex-A72 processor supports all addressing modes, data types, and operations of the Advanced 
SIMD instructions. 


14.1.2 Floating-point support 


The Cortex-A72 processor supports all addressing modes, data types, and operations of the Floating- 
point instructions. It does not support floating-point exception trapping. 
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14.2 Programmers model for Advanced SIMD and Floating-point 


Software can identify the Cortex-A72 processor Advanced SIMD and Floating-point features by using 
the feature identification registers in the AArch64 and AArch32 states. 


You can access the feature identification registers in AArch64 state using the MRS instructions, for 
example: 
MRS <Xt>, MVFR@_EL1 ; Read MVFR@_EL1 into Xt 


MRS <Xt>, MVFR1_EL1 ; Read MVFR1_EL1 into Xt 
MRS <Xt>, MVFR2_EL1 ; Read MVFR2_EL1 into Xt 


You can access the feature identification registers in AArch32 state using the VMRS instruction, for 
example: 


Read FPSID into Rt 
Read MVFR@ into Rt 
Read MFFR1 into Rt 
Read MVFR2 into Rt 


VMRS <Rt>, FPSID 
VMRS <Rt>, MVFRO@ 
VMRS <Rt>, MVFR1 
VMRS <Rt>, MVFR2 


3 
3 
3 
3 


The following table lists the feature identification registers for the Advanced SIMD and Floating-point. 


Table 14-1 Advanced SIMD and Floating-point feature identification registers 





AArch64 name AArch32 name Description 




















- FPSID See 14.6.1 Floating-point System ID Register on page 14-525 

MVFRO EL1 MVFRO See 14.4.3 Media and VFP Feature Register 0, ELI on page 14-518 

MVFRI EL1 MVFRI See 14.4.4 Media and VFP Feature Register 1, EL] on page 14-519 

MVFR2 EL1 MVFR2 See 14.4.5 Media and VFP Feature Register 2, EL] on page 14-520 
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14.3 AArch64 register summary 


The following table gives a summary of the Cortex-A72 processor Advanced SIMD and Floating-point 
System registers in AArch64 state. All AArch64 registers are 32-bit wide. 


Table 14-2 AArch64 Advanced SIMD and Floating-point System registers 











Name Type Reset Description 
FPCR RW 0x@0000008 See 74.4.1 Floating-point Control Register on page 14-515 
FPSR RW 0x@0000008 See 74.4.2 Floating-point Status Register on page 14-516 





MVFRO EFLI RO  0x10110222 See 14.4.3 Media and VFP Feature Register 0, ELI on page 14-518 





MVFRI ELI! RO  @x12111111 See 14.4.4 Media and VFP Feature Register 1, ELI on page 14-519 





MVFR2 ELI RW 0x00000043 See 14.4.5 Media and VFP Feature Register 2, ELI on page 14-520 





FPEXC32_EL2 RW 0x@00@070@ See 14.4.6 Floating-point Exception Control Register 32, EL2 on page 14-521 
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14.4 AArch64 register descriptions 


This section describes the AArch64 Advanced SIMD and Floating-point System registers in the Cortex- 
A72 processor. 


Table 14-2 AArch64 Advanced SIMD and Floating-point System registers on page 14-514 provides 
cross-references to individual registers. 


This section contains the following subsections: 

¢ 14.4.1 Floating-point Control Register on page 14-515. 

¢ 14.4.2 Floating-point Status Register on page 14-516. 

¢ 14.4.3 Media and VFP Feature Register 0, ELI on page 14-518. 

¢ 14.4.4 Media and VFP Feature Register 1, ELI on page 14-519. 

¢ 14.4.5 Media and VFP Feature Register 2, ELI on page 14-520. 

¢ 14.4.6 Floating-point Exception Control Register 32, EL2 on page 14-521. 


14.4.1 Floating-point Control Register 


The FPCR characteristics are: 


Purpose 
Controls floating-point extension behavior. 
Usage constraints 
The accessibility to the FPCR by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





RW RW RW RW RW RW 





Configurations 
The FPCR is part of the Floating-point functional group. 


The named fields in this register map to the equivalent fields in the AArch32 FPSCR. 


Attributes 
See the register summary in Table 14-2 AArch64 Advanced SIMD and Floating-point System 
registers on page 14-514. 


The following figure shows the FPCR bit assignments. 


27 26 25 24 23 22 21 0 


Bi 


Figure 14-1 FPCR bit assignments 
The following table shows the FPCR bit assignments. 


Table 14-3 FPCR bit assignments 





Bits Name Function 





[31:27] - Reserved, RESO. 





[26] AHP Alternative half-precision control bit: 


0 IEFE half-precision format selected. 


1 Alternative half-precision format selected. 
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Table 14-3 FPCR bit assignments (continued) 





Bits Name 


Function 








[25] DN Default NaN mode control bit: 
0 NaN operands propagate through to the output of a floating-point operation. 
1 Any operation involving one or more NaNs returns the Default NaN. 

[24] FZ Flush-to-zero mode control bit: 


0 Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant with the IEEE 754 
standard. 


1 Flush-to-zero mode enabled. 





[23:22] RMode 


Rounding Mode control field: 


@bee Round to Nearest (RN) mode. 

@be1 Round towards Plus Infinity (RP) mode. 
@b10 Round towards Minus Infinity (RM) mode. 
@b11 Round towards Zero (RZ) mode. 





[21:0] - 


Reserved, RESO. 





To access FPCR in AArch6é4 state, read or write the register with: 


MRS <Xt>, FPCR; Read Floating-point Control Register 
MSR FPCR, <Xt>; Write Floating-point Control Register 


14.4.2 Floating-point Status Register 


The FPSR characteristics are: 


Purpose 

Provides floating-point system status information. 
Usage constraints 

The accessibility to the FPSR by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS 


= 0) 





RW RW RW RW RW RW 





Configurations 
The FPSR is part of the Floating-point functional group. 


The named fields in this register map to the equivalent fields in the AArch32 FPSCR. 


Attributes 


See the register summary in Table 14-2 AArch64 Advanced SIMD and Floating-point System 


registers on page 14-514. 
The following figure shows the FPSR bit assignments. 
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31 30 29 28 27 26 876543 21 0 





L_ac IDC— ixc—! L— ioc 
UFC DZC 
OFC 


Figure 14-2 FPSR bit assignments 
The following table shows the FPSR bit assignments. 


Table 14-4 FPSR bit assignments 





Name Function 





N 


Negative condition flag for floating-point comparison operations: 


AArch32 Negative condition flag. 
AArch64 Sets the N bit in the main processor state (PSTATE) condition code flag. 





[30] 


Zero condition flag for floating-point comparison operations: 


AArch32 Zero condition flag. 
AArch64 Sets the PSTATE.Z condition code flag. 





[29] 


Carry condition flag for floating-point comparison operations: 


AArch32 Carry condition flag. 
AArch64 Sets the PSTATE.C condition code flag. 





[28] 


Overflow condition flag for floating-point comparison operations: 


AArch32 Overflow condition flag. 
AArch64 Sets the PSTATE.V condition code flag. 





Cumulative saturation bit, Advanced SIMD only. This bit is set to 1 to indicate that an Advanced SIMD integer 
operation has saturated since 0 was last written to this bit. 





Reserved, RESO. 





Input Denormal cumulative exception bit. This bit is set to 1 to indicate that the Input Denormal exception has 
occurred since 0 was last written to this bit. 





Reserved, RESO. 





Inexact cumulative exception bit. This bit is set to 1 to indicate that the Inexact exception has occurred since 0 was last 
written to this bit. 





UFC 


Underflow cumulative exception bit. This bit is set to 1 to indicate that the Underflow exception has occurred since 0 
was last written to this bit. 





OFC 


Overflow cumulative exception bit. This bit is set to 1 to indicate that the Overflow exception has occurred since 0 
was last written to this bit. 





DZC 


Division by Zero cumulative exception bit. This bit is set to 1 to indicate that the Division by Zero exception has 
occurred since 0 was last written to this bit. 








IOC 


Invalid Operation cumulative exception bit. This bit is set to 1 to indicate that the Invalid Operation exception has 
occurred since 0 was last written to this bit. 
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To access FPSR in AArch64 state, read or write the register with: 


MRS <Xt>, FPSR; Read Floating-point Status Register 
MSR FPSR, <Xt>; Write Floating-point Status Register 


14.4.3 Media and VFP Feature Register 0, EL1 


The MVFRO ELI characteristics are: 


Purpose 
The MVFRO ELI must be interpreted with the MVFR1_EL1 and the MVFR2_ ELI to describe 
the features provided by the Advanced SIMD and FP functions. 

Usage constraints 
The accessibility to the MVFRO_EL1 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 
- RO RO RO RO RO 





The accessibility to the MVFRO in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS=1) EL3(SCR.NS = 0) 
- Config RO Config Config RO 





Configurations 
MVFRO_EL1 is: 


* Common to Secure and Non-secure states 
e Architecturally mapped to AArch32 MVFRO register. 


Attributes 
See the register summary in Table 14-2 AArch64 Advanced SIMD and Floating-point System 
registers on page 14-514. 


The following figure shows the MVFRO_EL1 bit assignments. 


28 27 24 23 20 19 16 15 12 11 


FPRound | FPShVec FPSart FPDivide FPTrap FPDP FPSP SIMDReg 


Figure 14-3 MVFRO_EL1 bit assignments 
The following table shows the MVFRO_ELI bit assignments. 


Table 14-5 MVFRO_EL1 bit assignments 





Bits Name Function 





[31:28] FPRound Indicates the rounding modes supported by the FP floating-point hardware: 
@x1 All rounding modes supported. 





[27:24] FPShVec Indicates the hardware support for FP short vectors: 


Ox® Not supported. 








[23:20] FPSqrt Indicates the hardware support for FP square root operations: 


0x1 Supported. 
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Table 14-5 MVFRO_EL1 bit assignments (continued) 





Bits Name Function 





[19:16] FPDivide Indicates the hardware support for FP divide operations: 
@x1 Supported. 





[15:12] FPTrap Indicates whether the FP hardware implementation supports exception trapping: 


0x0 Not supported. 





[11:8] FPDP Indicates the hardware support for FP double-precision operations: 
0x2 Supported, VFPv3 or greater. 


See the ARM” Architecture Reference Manual ARMVé8 for more information. 





[7:4] | FPSP Indicates the hardware support for FP single-precision operations: 


0x2 Supported, VFPv3 or greater. 


See the ARM” Architecture Reference Manual ARMVé8 for more information. 





[3:0] | SIMDReg Indicates support for the Advanced SIMD register bank: 


0x2 32x 64-bit registers supported. 


See the ARM® Architecture Reference Manual ARMv8 for more information. 





To access the MVFRO_ ELI register, see 74.2 Programmers model for Advanced SIMD and Floating- 
point on page 14-513. 


14.4.4 Media and VFP Feature Register 1, EL1 


The MVFRI1_ ELI characteristics are: 


Purpose 
The MVFRI ELI must be interpreted with the MVFRO_EL1 and the MVFR2_EL1 to describe 
the features provided by the Advanced SIMD and FP functions. 

Usage constraints 
The accessibility to the MVFR1_EL1 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The accessibility to the MVFR1 in AArch32 state by Exception level is: 





ELO EL1(NS) EL4(S) EL2 EL3(SCR.NS=1) EL3(SCR.NS = 0) 





- Config RO Config Config RO 





Configurations 
The MVFRI ELI is: 
e Common to Secure and Non-secure states. 
e Architecturally mapped to AArch32 MVFRI1 register. 


Attributes 
See the register summary in Table 14-2 AArch64 Advanced SIMD and Floating-point System 
registers on page 14-514. 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 14-519 
Non-Confidential 


14 Advanced SIMD and Floating-point 
14.4 AArch64 register descriptions 


The following figure shows the MVFR1_EL1 bit assignments. 


28 27 24 23 20 19 16 15 12 11 


SIMDFMAC| FPHP SIMDHP | SIMDSP SIMDInt SIMDLS | FPDNaN FPFtZ 


Figure 14-4 MVFR1_EL1 bit assignments 
The following table shows the MVFR1_ELI bit assignments. 


Table 14-6 MVFR1_EL1 bit assignments 


Bits Name Function 





[31:28] SIMDFMAC Indicates whether the Advanced SIMD or FP supports fused multiply accumulate operations: 





@x1 Supported. 
[27:24] FPHP Indicates whether the FP supports half-precision floating-point conversion operations: 
0x2 Supported. 








[23:20] SIMDHP Indicates whether the Advanced SIMD supports half-precision floating-point conversion operations: 


0x1 Supported. 








[19:16] SIMDSP Indicates whether the Advanced SIMD supports single-precision floating-point operations: 
0x1 Supported. 








[15:12] SIMDInt Indicates whether the Advanced SIMD supports integer operations: 
0x1 Supported. 





[11:8] SIMDLS Indicates whether the Advanced SIMD supports load/store instructions: 
0x1 Supported. 





[7:4]  FPDNaN Indicates whether the FP hardware implementation supports only the Default NaN mode: 





0x1 Hardware supports propagation of NaN values. 
[3:0] FPFtZ Indicates whether the FP hardware implementation supports only the Flush-to-zero mode of operation: 
0x1 Hardware supports full denormalized number arithmetic. 





To access the MVFRI1_ ELI register, see 74.2 Programmers model for Advanced SIMD and Floating- 
point on page 14-513. 


14.4.5 Media and VFP Feature Register 2, EL1 


The MVFR2 ELI characteristics are: 


Purpose 
The MVFR2_ ELI! must be interpreted with the MVFRO_EL1 and the MVFRI_ELI to describe 
the features provided by the Advanced SIMD and FP functions. 
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Usage constraints 
The accessibility to the MVFR2_EL1 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- RO RO RO RO RO 





The accessibility to the MVFR2 in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS=1) EL3(SCR.NS = 0) 





- Config RO Config Config RO 





Configurations 
The MVFR2 ELI is: 


¢ Common to Secure and Non-secure states. 
e Architecturally mapped to AArch32 MVFR2 register. 


Attributes 
See the register summary in Table 14-2 AArch64 Advanced SIMD and Floating-point System 
registers on page 14-514. 


The following figure shows the MVFR2_EL1 bit assignments. 


31 8 7 4 3 0 


Figure 14-5 MVFR2_EL1 bit assignments 
The following table shows the MVFR2_EL1 bit assignments. 


Table 14-7 MVFR2_EL1 bit assignments 











Bits Name Function 
[31:8] - Reserved, RESO. 
[7:4] FPMisc Floating-point miscellaneous features supported. This value is: 


0be100 Includes support for the following features: 
e Floating-point selection. 
e Floating-point Conversion to Integer with Directed Rounding modes. 
¢ Floating-point Round to Integral floating-point. 
e Floating-point MaxNum and MinNum. 





[3:0] _SIMDMisc Advanced SIMD miscellaneous features supported. This value is: 


@be11 Includes support for the following features: 
e Floating-point Conversion to Integer with Directed Rounding modes. 
¢ Floating-point Round to Integral floating-point. 
e Floating-point MaxNum and MinNum. 





To access the MVFR2_ ELI register, see 74.2 Programmers model for Advanced SIMD and Floating- 
point on page 14-513. 


14.4.6 Floating-point Exception Control Register 32, EL2 


The FPEXC32_EL2 characteristics are: 





ARM 100095 _0003_05_en Copyright © 2014-2016 ARM. All rights reserved. 14-521 
Non-Confidential 


14 Advanced SIMD and Floating-point 
14.4 AArch64 register descriptions 


Purpose 
Provides access to the AArch32 register FPEXC from AArch64 state only. Its value has no 
effect on execution in AArch64 state. 

Usage constraints 
The accessibility to the FREXC32_EL2 in AArch64 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS =1) EL3(SCR.NS = 0) 





- - - RW RW RW 





The accessibility to the FREXC in AArch32 state by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





- Config RW Config Config RW 





Configurations 
The FPEXC32_EL2 is: 


¢ Common to Secure and Non-secure states. 
e Architecturally mapped to AArch32 FPEXC register. 


Attributes 
See the register summary in Table 14-2 AArch64 Advanced SIMD and Floating-point System 
registers on page 14-514. 


The following figure shows the FREXC32_EL2 bit assignments. 
31 30 29 11 10 8 7 0 


ey mem mt so 


Figure 14-6 FPEXC32_EL2 bit assignments 
The following table shows the FPEXC32_EL2 bit assignments. 


Table 14-8 FPEXC32_EL2 bit assignments 





Bits Name Function 





[31] EX Exception bit. The Cortex-A72 processor implementation does not generate asynchronous 
FP exceptions, so this bit is RESO. 





[30] EN bit, VFPdescriptionVFP Enable bit. A global enable for the Advanced SIMD and FP functions: 
enable bitdescriptionEN 0 The Advanced SIMD and FP functions are disabled. 
1 The Advanced SIMD and FP functions are enabled and operate normally. 


The EN bit is cleared at reset. See the ARM® Architecture Reference Manual ARMv8 for 
more information. 

















[29:11] - Reserved, RESO. 
[10:8] - Reserved, RES1. 
[7:0] - Reserved, RESO. 
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To access the FPEXC_EL2 register, see 74.2 Programmers model for Advanced SIMD and Floating- 
point on page 14-513. 
Note 


The Cortex-A72 processor implementation does not support deprecated FP short vector feature. You can 
use software to emulate the short vector feature, if required. 
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14 Advanced SIMD and Floating-point 
14.5 AArch32 register summary 


The following table gives a summary of the Advanced SIMD and Floating-point System registers in the 
Cortex-A72 processor when in AArch32 state. 


Table 14-9 AArch32 Advanced SIMD and Floating-point System registers 





























Name Type Reset Description 

FPSID RO 0x41034080 See 74.6.1 Floating-point System ID Register on page 14-525 

FPSCR RW _ 0x0@@000008 See /4.6.2 Floating-point Status and Control Register on page 14-526 

MVFRO RO 0x10110222 See /4.4.3 Media and VFP Feature Register 0, EL1 on page 14-518 

MVFR1 RO 6x12111111 See 74.4.4 Media and VFP Feature Register 1, EL1 on page 14-519 

MVFR2 RW 0x00000043 See /4.4.5 Media and VFP Feature Register 2, EL1 on page 14-520 

FPEXC RW 0x00000700 See /4.4.6 Floating-point Exception Control Register 32, EL2 on page 14-521 
Note 


The Floating-point Instruction Registers, FPINST and FPINST2 are not implemented, and any attempt to 
access them is UNPREDICTABLE. 





See the ARM® Architecture Reference Manual ARMVé8 for information about permitted accesses to the 
Advanced SIMD and Floating-point System registers. 
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14.6 AArch32 register descriptions 


This section describes the AArch32 Advanced SIMD and Floating-point System registers in the Cortex- 
A72 processor. 


Table 14-9 AArch32 Advanced SIMD and Floating-point System registers on page 14-524 provides 
cross-references to individual registers. 


This section contains the following subsections: 
¢ 14.6.1 Floating-point System ID Register on page 14-525. 
¢ 14.6.2 Floating-point Status and Control Register on page 14-526. 


14.6.1 Floating-point System ID Register 


The FPSID characteristics are: 


Purpose 

Provides top-level information about the floating-point implementation. 
Usage constraints 

The accessibility to the FPSID by Exception level is: 





ELO EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 








- Config RO Config Config RO 
Configurations 
The FPSID is Common to Secure and Non-secure states. 
Attributes 


See the register summary in Table 14-9 AArch32 Advanced SIMD and Floating-point System 
registers on page 14-524. 


The following figure shows the FPSID bit assignments. 


31 24 23 22 16 15 8 7 4 3 0 
sw— 


Figure 14-7 FPSID bit assignments 
The following table shows the FPSID bit assignments. 


Table 14-10 FPSID bit assignments 





Bits Name Function 





[31:24] Implementer Indicates the implementer: 





0x41 ARM Limited. 
[23] SW Software bit. This bit indicates whether a system provides only software emulation of the floating-point 
instructions: 


@x@ The system includes hardware support for floating-point operations. 
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Table 14-10 FPSID bit assignments (continued) 





Bits Name Function 





[22:16] Subarchitecture Subarchitecture version number: 


@x@3 VFPv3 architecture, or later, with no subarchitecture. The entire floating-point implementation is in 
hardware, and no software support code is required. 


The VFP architecture version is indicated by the MVFRO, MVFR1, and MVFR2 registers. 











[15:8] PartNum Indicates the part number for the floating-point implementation: 
0x40 VFP. 

[7:4] Variant Indicates the variant number: 
0x8 Cortex-A72 processor. 

[3:0] Revision Indicates the revision number for the floating-point implementation: 
0x0 Revision. 





To access the FPSID register, see 14.2 Programmers model for Advanced SIMD and Floating-point 
on page 14-513. 


14.6.2 Floating-point Status and Control Register 


The FPSCR characteristics are: 


Purpose 

Provides floating-point system status information and control. 
Usage constraints 

The accessibility to the FPSCR by Exception level is: 





ELO (NS) ELO (S) EL1(NS) EL1(S) EL2 EL3(SCR.NS = 1) EL3(SCR.NS = 0) 





Config RW Config RW Config Config RW 





Configurations 
The FPSCR is Common to Secure and Non-secure states. 


The named fields in this register map to the equivalent fields in the AArch64 FPCR and FPSR. 


Attributes 
See the register summary in Table 14-9 AArch32 Advanced SIMD and Floating-point System 
registers on page 14-524. 


The following figure shows the FPSCR bit assignments. 


31 30 29 28 27 26 25 24 23 22 21 20 1918 1615 876543210 





ac— L— RESO L—IDC L_1oc 
AHP DZC 
DN OFC 
FZ UFC 
RMode IXC 
Stride 





Figure 14-8 FPSCR bit assignments 
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The following table shows the FPSCR bit assignments. 


Table 14-11 FPSCR bit assignments 





Bits 


Field 


Function 





FP Negative condition code flag. 


Set to 1 if a FP comparison operation produces a less than result. 





FP Zero condition code flag. 


Set to 1 if a FP comparison operation produces an equal result. 








FP Carry condition code flag. 


Set to 1 if a FP comparison operation produces an equal, greater than, or unordered result. 





FP Overflow condition code flag. 


Set to 1 if a FP comparison operation produces an unordered result. 








QC 


Cumulative saturation bit. 


This bit is set to 1 to indicate that an Advanced SIMD integer operation has saturated after 0 was last written to this 
bit. 





[26] 


AHP 


Alternative Half-Precision control bit: 


0 IEEE half-precision format selected. 


1 Alternative half-precision format selected. 





[25] 


DN 


Default NaN mode control bit: 
0 NaN operands propagate through to the output of a floating-point operation. 


1 Any operation involving one or more NaNs returns the Default NaN. 


The value of this bit only controls FP arithmetic. In AArch32 state, Advanced SIMD arithmetic always uses the 
Default NaN setting, regardless of the value of the DN bit. 





[24] 


FZ 


Flush-to-zero mode control bit: 


0 Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant with the IEEE 754 
standard. 


1 Flush-to-zero mode enable. 


The value of this bit only controls FP arithmetic. In AArch32 state, Advanced SIMD arithmetic always uses the 
Flush-to-zero setting, regardless of the value of the FZ bit. 





[23:22] RMode 


Rounding Mode control field: 


ebee Round to Nearest (RN) mode. 

@be1 Round towards Plus Infinity (RP) mode. 
0b10 Round towards Minus Infinity (RM) mode. 
0b11 Round towards Zero (RZ) mode. 


The specified rounding mode is used by almost all FP floating-point instructions. In AArch32 state, Advanced 
SIMD arithmetic always uses the Round to Nearest setting, regardless of the value of the RMode bits. 





[21:20] Stride 


Reserved, RES0. 














[19] - Reserved, RESO. 
[18:16] Len Reserved, RESO. 
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Table 14-11 FPSCR bit assignments (continued) 






































Bits Field Function 

[15:8] - Reserved, RESO. 

[7] IDC Input Denormal cumulative exception bit. This bit is set to 1 to indicate that the Input Denormal exception has 
occurred since 0 was last written to this bit. 

[6:5] - Reserved, RESO. 

[4 IXC Inexact cumulative exception bit. This bit is set to 1 to indicate that the Inexact exception has occurred since 0 was 
last written to this bit. 

[3 UFC Underflow cumulative exception bit. This bit is set to 1 to indicate that the Underflow exception has occurred since 
0 was last written to this bit. 

[2] OFC Overflow cumulative exception bit. This bit is set to 1 to indicate that the Overflow exception has occurred since 0 
was last written to this bit. 

[1] DZC Division by Zero cumulative exception bit. This bit is set to 1 to indicate that the Division by Zero exception has 
occurred since 0 was last written to this bit. 

[0] IOC Invalid Operation cumulative exception bit. This bit is set to 1 to indicate that the Invalid Operation exception has 
occurred since 0 was last written to this bit. 
To access the FPSCR register, see 714.2 Programmers model for Advanced SIMD and Floating-point 
on page 14-513. 
Related information 
14.4.1 Floating-point Control Register on page 14-515. 
14.4.2 Floating-point Status Register on page 14-516. 
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This section describes the Cortex-A72 processor signals. 


It contains the following sections: 


A.1 About the signal descriptions on page Appx-A-530. 
A.2 Clock signals on page Appx-A-531. 

A.3 Reset signals on page Appx-A-532. 

A.4 Configuration signals on page Appx-A-533. 

A.5 GIC CPU interface signals on page Appx-A-535. 
A.6 Generic Timer signals on page Appx-A-537. 

A.7 Power control signals on page Appx-A-538. 

A.8 ACE and CHI interface signals on page Appx-A-540. 
A.9 CHI interface signals on page Appx-A-543. 

A.10 ACE interface signals on page Appx-A-548. 

A.11 ACP interface signals on page Appx-A-553. 

A.12 Debug interface signals on page Appx-A-556. 

A.13 ETM interface on page Appx-A-559. 

A.14 Cross trigger channel interface on page Appx-A-561. 
A.15 PMU signals on page Appx-A-562. 

A.16 DFT and MBIST signals on page Appx-A-563. 
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A.1 About the signal descriptions 


The tables in this appendix list the Cortex-A72 processor signals, along with their direction, input or 
output, and a high-level description. 


Some of the buses include a configurable width field, <signal>[N:0], where N = 0, 1, 2, or 3, to encode 
up to four cores. For example: 


e nIRQJ[O0] represents a core 0 interrupt request. 
e nIRQJ[2] represents a core 2 interrupt request. 


Some signals are specified in the form <signal>x, where x = 0, 1, 2 or 3 references core 0, core 1, core 2, 
or core 3, respectively. If a core is not present, the corresponding pin is removed. For example: 

e PMUEVENT0[24:0] represents the core 0 PMU event bus. 

e PMUEVENT3([24:0] represents the core 3 PMU event bus. 


The number of signals changes depending on the configuration. For example, the CHI interface signals 
are not present when the processor is configured to have an ACE interface. 
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A.2 Clock signals 
The following table shows the clock and clock enable signals. 


Table A-1 Clock and clock enable signals 





Signal Type Description 





CLK Input Global clock. 





CLKEN Input Global clock enable. This signal can only be deasserted when all the cores in the processor device and the L2 are in 
WFI low-power state, and the ACE/CHI and ACP interfaces are idle. 





Related information 
2.3 Clocking and resets on page 2-32. 
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A.3 Reset signals 


The following table shows the reset and reset control signals. 


Table A-2 Reset signals 





Signal Type 


Description 





nCPUPORESET|[N:0] Input 


Individual processor powerup resets: 
0 Apply reset to the processor including Debug, ETM, breakpoint and watchpoint logic. 


1 Do not apply reset to the processor. 





nCORERESET[N:0] Input 


Individual processor reset excluding Debug and ETM: 


0 Apply reset to the processor excluding Debug, ETM, breakpoint and watchpoint logic. 


1 Do not apply reset to the processor. 





WARMRSTREQJN:0] Output 


Individual processor Warm reset request: 
0 Do not apply Warm reset to processor. 


1 Apply Warm reset to processor. 


This output is controlled by Reset request bit in the Reset Management Register (RMR or 
RMR EL3). 








nL2RESET Input L2 reset: 

0 Apply reset to shared L2 memory system controller. 

1 Do not apply reset to shared L2 memory system controller. 
L2RSTDISABLE Input Disable automatic L2 cache invalidate at reset: 


0 L2 cache is reset by hardware. 


1 L2 cache is not reset by hardware. 





Related information 
2.3.2 Resets on page 2-36. 
2.3 Clocking and resets on page 2-32. 
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A.4 Configuration signals 


The following table shows the configuration signals. 


Table A-3 Configuration inputs 





Signal 


Type 


Description 





CFGENDJN:0] 


Input 


Individual core control of the endianness configuration at reset. It sets the initial value of the EE 
bit in the System Control Register (SCTLR or SCTLR_EL3): 


0 EE bit is 0. 
1 EE bit is 1. 


This signal is only sampled during powerup reset of the processor. 





VINITHI[N:0] 


Input 


Individual core control of the location of the exception vectors at reset. It sets the initial value of 
the V bit in the CP15 System Control Register (SCTLR when the highest Exception level is 
AArch32): 


0 Exception vectors start at address 0x00000000. 
1 Exception vectors start at address OxF FFFQQ0O. 


This signal is only sampled during powerup reset of the processor. 





CFGTE[N:0] 


Input 


Individual core control of the default exception handling state. It sets the initial value of the TE 
bit in the CP15 System Control Register (SCTLR when the highest Exception level is AArch32): 


0 TE bit is 0. 
1 TE bit is 1. 


This signal is only sampled during powerup reset of the processor. 





CPIS5SDISABLE[N:0] 


Input 


Disable write access to some Secure CP15 registers. See 4.7.17 Registers affected by 
CPISSDISABLE on page 4-74. 





CLUSTERIDAFF1[7:0] 


Input 


Value read in the Cluster ID Affinity Level-1 field, bits[15:8], of the Multiprocessor Affinity 
Register (MPIDR). 


This signal is only sampled during powerup reset of the processor. 





CLUSTERIDAFE?[7:0] 


Input 


Value read in the Cluster ID Affinity Level-2 field, bits[23:16], of the Multiprocessor Affinity 
Register (MPIDR). 


This signal is only sampled during powerup reset of the processor. 





AA64nAA32[N:0] 


Input 


Individual core register width state. The register width states are: 


0 AArch32. 
1 AArché64. 


This signal is only sampled during powerup reset of the processor. 
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Table A-3 Configuration inputs (continued) 





Signal Type Description 





RVBARADDRx[43:2]* Input Reset Vector Base Address for executing in AArch64 state. This signal is only sampled during 
reset of the processor. 





CRYPTODISABLE|[N:0]® Input Individual core Cryptography engine disable: 
0 Enable the Cryptography engine. 
1 Disable the Cryptography engine. 


This signal is only sampled during powerup reset of the processor. This signal only exists if the 
processor implements the Cryptography Extension. 








fa xis 0, 1, 2, or 3 to reference a specific core. 
fb The optional Cryptography engine is not included in the base product of the processor. ARM requires licensees to have contractual rights to obtain the Cortex-A72 


processor Cryptography engine. 
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A.5 GIC CPU interface signals 


The following table shows the Generic Interrupt Controller (GIC) CPU interface signals. 


Table A-4 GIC CPU interface signals 





Signal 


Type 


Description 





nIRQ[N:0] 


Input 


Individual core IRQ request input. Active-LOW, interrupt request: 
0 Activate IRQ request. 


1 Do not activate IRQ request. 


The processor treats nIRQ as level-sensitive. nIRQ must remain asserted until the processor 
acknowledges the interrupt. 


This signal is only used when IRQ is in bypass mode, and used as legacy IRQ. 





nFIQ[N:0] 


Input 


Individual processor FIQ request input. Active-LOW, FIQ request: 
0 Activate FIQ request. 


1 Do not activate FIQ request. 


The processor treats nFIQ as level-sensitive. nFIQ must remain asserted until the processor 
acknowledges the interrupt. 


This signal is only used when FIQ is in bypass mode, and used as legacy FIQ. 





nVIRQ[N:0] 


Input 


Individual processor virtual IRQ request input. Active-LOW, virtual IRQ request: 


0 Activate virtual IRQ request. 
1 Do not activate virtual IRQ request. 


The processor treats nVIRQ as level-sensitive. nVIRQ must remain asserted until the processor 
acknowledges the interrupt. 





nVFIQ[N:0] 


Input 


Individual processor virtual FIQ request input. Active-LOW, virtual FIQ request: 


0 Activate virtual FIQ request. 


1 Do not activate virtual FIQ request. 


The processor treats nVFIQ as level-sensitive. nVFIQ must remain asserted until the processor 
acknowledges the interrupt. 





nSEI[N:0] 


Input 


Individual processor System Error Interrupt request. Active-LOW, SEI request: 
0 Activate SEI request. 


1 Do not activate SEI request. 


The processor treats nSEI as edge-sensitive. The nSEI signal must be sent as a pulse to the 
processor. 





nREI[N:0] 


Input 


Individual core RAM Error Interrupt request. Active-LOW, REI request. 


0 Activate REI request. Reports an asynchronous RAM error in the system. 


1 Do not activate REI request. 


The processor treats nREI as edge-sensitive. nREI must be sent as a pulse to the processor. 
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Table A-4 GIC CPU interface signals (continued) 





Signal Type 


Description 





nVSEI[N:0] Input 


Individual core virtual System Error Interrupt request. Active-LOW, virtual SEI request: 


0 Activate virtual SEI request. 


1 Do not activate virtual SEI request. 


The processor treats nVSEI as edge-sensitive. nVSEI must be sent as a pulse to the processor. 





nVCPUMNTIRQIN:0] Output 


Individual core virtual CPU interface maintenance interrupt request. Processor N sets this signal 
LOW to issue a maintenance interrupt request to the external Distributor. 





PERIPHBASE[43:18] Input 


Specifies the base address for the GIC registers. This value is sampled into the Configuration Base 
Address Register (CBAR) at reset. 





GICCDISABLE Input 


Disables the GIC CPU interface logic and routes the legacy nIRQ, nFIQ, nVIRQ, and nVFIQ 
signals directly to the processor: 


0 Enable the GIC CPU interface logic. 
1 Disable the GIC CPU interface logic. 


This signal is only sampled during powerup reset of the processor. 





AXI4 Stream protocol signals: * 
































ICDTVALID Input When HIGH it indicates that the Distributor is driving a valid transfer. 
ICDTREADY Output When HIGH it indicates that the processor can accept a transfer in the current cycle. 
ICDTDATA[15:0] Input The primary payload that passes data from the Distributor to the processor. 
ICDTLAST Input When HIGH it indicates the boundary of a packet. 

ICDTDEST[1:0] Input Provides routing information for the data stream from the Distributor. 

ICCTVALID Output When HIGH it indicates that the processor is driving a valid transfer. 

ICCTREADY Input When HIGH it indicates that the Distributor can accept a transfer in the current cycle. 
ICCTDATA[15:0] Output The primary payload that passes data from the processor to the Distributor. 
ICCTLAST Output When HIGH it indicates the boundary of a packet. 

ICCTID[1:0] Output The data stream identifier that indicates different streams of data. 





Related information 

4.3.70 Configuration Base Address Register, ELI on page 4-212. 
4.5.24 Configuration Base Address Register on page 4-274. 
GICCDISABLE bypass mode on page 8-323. 





fe See the ARM” AMBA” AXI4-Stream Protocol Specification for more information. 
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A.6 Generic Timer signals 


The following table shows the Generic Timer signals. 


Table A-5 Generic Timer signals 





Signal Type Description 





CNTVALUEB[63:0] Input Global system counter value in binary format 





CNTCLKEN Input Counter clock enable 





nCNTPNSIRQ[N:0] Output Non-secure physical timer interrupt 





nCNTPSIRQ[N:0] Output Secure physical timer interrupt 





nCNTHPIRQ[N:0] Output Hypervisor physical timer interrupt 





nCNTVIRQ[N:0] Output Virtual timer interrupt 
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A.7 Power control signals 


The following table shows the power control signals. 


Table A-6 Power control signals 


















































Signal Type Description 
EVENTI Input Event input for processor wake-up from WFE low-power state. When this signal is asserted, it acts 
as a WFE wake-up event to all the processors in the MPCore device. This signal must be asserted 
for at least one CLK cycle. 
EVENTO Output Event output. This signal is asserted HIGH for three CLK cycles when any of the processors in the 
MPCore device executes an SEV instruction. 
CLREXMONREQ Input Clearing of the external global exclusive monitor request. When this signal is asserted, it acts as a 
WFE wake-up event to all the processors in the MPCore device. 
CLREXMONACK Output Clearing of the external global exclusive monitor acknowledge. 
STANDBYWFE|[N:0] Output Indicates whether a processor is in WFE low-power state: 
0 Processor not in WFE low-power state. 
1 Processor in WFE low-power state. 
STANDBYWFI[N:0] | Output Indicates whether a processor is in WFI low-power state: 
0 Processor not in WFI low-power state. 
1 Processor in WFI low-power state. 
STANDBYWFIL2 Output Indicates whether the L2 is in WFI low-power state. This signal is active when the following are 
true: 
¢ All processors are in WFI low-power state. 
e ACINACTM or SINACT and AINACTS are asserted HIGH. 
e L2 memory system is idle. 
L2FLUSHREQ Input L2 hardware flush request. This signal indicates: 
0 L2 hardware flush request is not asserted. 
1 L2 hardware flush request is asserted. 
L2FLUSHDONE Output L2 hardware flush done. 
0 L2 hardware flush is not finished. 
1 L2 hardware flush is finished. 
SMPEN|[N:0] Output CPUECTLR.SMPEN output. This signal indicates: 
0 The CPUECTLR.SMPEN bit is not set. 
1 The CPUECTLR.SMPEN bit is set. 
CPUQACTIVE|[N:0] Output When HIGH, it indicates that processor N is active. 
CPUQREQ?I[N:0] Input The power controller sets this signal LOW, to request that processor N enters retention state. 
CPUQACCEPT2[N:0] Output This signal goes LOW, if processor N accepts the power controller retention request. 
CPUQDENY|([N:0] Output When HIGH, it indicates that processor N denies the power controller retention request. 
L2QACTIVE Output When HIGH, it indicates that the L2 Data and Tag RAMs are active. 
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Table A-6 Power control signals (continued) 














Signal Type Description 

L2QREQn Input The power controller sets this signal LOW, to request that the L2 Data and Tag RAMs enter 
retention state. 

L2QACCEPTn Output This signal goes LOW, if the L2 Data and Tag RAMs accept the power controller retention request. 

L2QDENY Output When HIGH, it indicates that the L2 Data and Tag RAMs deny the power controller retention 
request. 





Related information 

Event communication using WFE and SEV instructions on page 2-43. 
CLREXMON request and acknowledge signaling on page 2-43. 
4.3.67 CPU Extended Control Register, EL] on page 4-206. 
Processor dynamic retention on page 2-46. 

L2 RAMs dynamic retention on page 2-48. 
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A.8 ACE and CHI interface signals 
This section describes the ACE and CHI interface signals. 


This section contains the following subsections: 
e A.8.1 Configuration signals on page Appx-A-540. 
e A.8.2 Asynchronous error signals on page Appx-A-542. 


A.8.1 Configuration signals 


The following table shows the configuration signals that are common to the ACE and CHI interfaces. 


Table A-7 ACE or CHI configuration inputs 





Signal Type Description 
BROADCASTINNER Input Enable broadcasting of Inner Shareable 
transactions: 


0 Inner Shareable transactions are not 
broadcasted externally. 


1 Inner Shareable transactions are 
broadcasted externally. 


If BROADCASTINNER is tied HIGH, 
BROADCASTOUTER must also be tied 
HIGH. 


This signal is only sampled during 
powerup reset of the processor. 





BROADCASTOUTER Input Enable broadcasting of Outer Shareable 
transactions: 


0 Outer Shareable transactions are not 
broadcasted externally. 


1 Outer Shareable transactions are 
broadcasted externally. 


This signal is only sampled during 
powerup reset of the processor. 








ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. Appx-A-540 
Non-Confidential 


A Signal Descriptions 
A.8 ACE and CHI interface signals 


Table A-7 ACE or CHI configuration inputs (continued) 





Signal Type Description 





BROADCASTCACHEMAINT Input Enable broadcasting of cache maintenance 
operations to downstream caches: 


0 Cache maintenance operations are not 
broadcasted to downstream caches. 


1 Cache maintenance operations are 
broadcasted to downstream caches. 


This signal is only sampled during 
powerup reset of the processor. 





SYSBARDISABLE Input Disable broadcasting of barriers on the 
system bus: 


0 Barriers are broadcast on the system 
bus. 


1 Barriers are not broadcast on the 
system bus. 


For AXI3 compatibility in ACE interface 
configurations, SYSBARDISABLE must 
be tied HIGH and the following signals 
LOW: 

* BROADCASTCACHEMAINT. 

* BROADCASTINNER. 

* BROADCASTOUTER. 


This signal is only sampled during 
powerup reset of the processor. 





Related information 
7.7.2 Interface modes on page 7-311. 
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A.8.2 Asynchronous error signals 


The following table shows the asynchronous error signals. 


Table A-8 Asynchronous error signals 





Signal Type Description 





nEXTERRIRQ Output Error indicator for an AXI or CHI write transaction with a write response error condition. 


Writing 0 to bit[29] of the L2ZECTLR clears the error indicator. 





nINTERRIRQ Output Error indicator for an L2 RAM double-bit ECC error. 
Writing 0 to bit[30] of the L2ZECTLR clears the error indicator. 





Related information 
4.3.59 L2 Extended Control Register, ELI on page 4-172. 





ARM 100095_0003_05 en Copyright © 2014-2016 ARM. All rights reserved. Appx-A-542 
Non-Confidential 


A.9 CHI interface signals 


A Signal Descriptions 
A.9 CHI interface signals 


This section shows the CHI interface signals. 





Note 


This interface only exists if the processor implements the CHI interface. 





This section contains the following subsections: 


¢ A.9.1 CHI clock and configuration signals on page Appx-A-543. 

e A.9.2 Transmit request virtual channel signals on page Appx-A-543. 

e A.9.3 Transmit response virtual channel signals on page Appx-A-544. 
¢ A.9.4 Transmit data virtual channel signals on page Appx-A-544. 

e A.9.5 Receive snoop virtual channel signals on page Appx-A-544. 

e A.9.6 Receive response virtual channel signals on page Appx-A-545. 
e A.9.7 Receive data virtual channel signals on page Appx-A-545. 

e A.9.8 System address map signals on page Appx-A-545. 


A.9.1 CHI clock and configuration signals 


The following table shows the clock and configuration signals for the CHI interface. 


Table A-9 CHI clock and configuration signals 
































Signal Type Description 
SCLKEN Input CHI interface clock enable 
SINACT Input CHI snoop active in 
NODEID{[6:0] Input CHI node identifier. This signal is only sampled during powerup reset of the processor. 
RXSACTIVE Input Receive pending activity indicator 
TXSACTIVE Output Transmit pending activity indicator 
RXLINKACTIVEREQ Input Receive link active request 
RXLINKACTIVEACK Output Receive link active acknowledge 
TXLINKACTIVEREQ Output Transmit link active request 
TXLINKACTIVEACK Input Transmit link active acknowledge 
A.9.2 Transmit request virtual channel signals 


The following table shows the transmit request virtual channel signals for the CHI interface. 


Table A-10 Transmit request virtual channel signals 





Signal Type Description 





TXREQFLITPEND Output Transmit request flit pending. 





TXREQFLITV Output Transmit request flit valid. 





TXREQFLIT[99:0] Output Transmit request flit payload.‘ 








fd TXREQFLIT[MemAttr] allocation hints based on outer memory attributes from MMU. 
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Table A-10 Transmit request virtual channel signals (continued) 





Signal Type Description 





TXREQLCRDV Input Transmit request link-layer credit valid. 





REQMEMATTR[7:0] Output Transmit request raw memory attributes: 
[7] Outer Shareable. 
[6:3] Outer memory attribute in MAIR format. 
[2] Inner Shareable. 





[1:0] bee Device. 
@be1 Normal Non-cacheable. 
0b10 Normal Write-Through. 
0b11 Normal Write-Back. 
A.9.3 Transmit response virtual channel signals 


The following table shows the transmit response virtual channel signals for the CHI interface. 


Table A-11 Transmit response virtual channel signals 


Signal Type Description 





TXRSPFLITPEND Output Transmit response flit pending 





TXRSPFLITV Output Transmit response flit valid 





TXRSPFLIT[44:0] Output Transmit response flit payload 





TXRSPLCRDV Input Transmit response link-layer credit valid 





A.9.4 Transmit data virtual channel signals 


The following table shows the transmit data virtual channel signals for the CHI interface. 


Table A-12 Transmit data virtual channel signals 





Signal Type Description 





TXDATFLITPEND Output Transmit data flit pending 





TXDATFLITV Output Transmit data flit valid 





TXDATFLIT[193:0] Output Transmit data flit payload 





TXDATLCRDV Input Transmit data link-layer credit valid 





A.9.5 Receive snoop virtual channel signals 


The following table shows the receive snoop virtual channel signals for the CHI interface. 
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Table A-13 Receive snoop virtual channel signals 





Signal Type Description 





RXSNPFLITPEND Input Receive snoop flit pending 





RXSNPFLITV Input Receive snoop flit valid 





RXSNPFLIT[64:0] Input Receive snoop flit payload 





RXSNPLCRDV Output Receive snoop link-layer credit valid 





A.9.6 Receive response virtual channel signals 


The following table shows the receive response virtual channel signals for the CHI interface. 


Table A-14 Receive response virtual channel signals 


Signal Type Description 





RXRSPFLITPEND Input Receive response flit pending 





RXRSPFLITV Input Receive response flit valid 





RXRSPFLIT[44:0] Input Receive response flit payload 





RXRSPLCRDV Output Receive response link-layer credit valid 





A.9.7 Receive data virtual channel signals 


The following table shows the receive data virtual channel signals for the CHI interface. 


Table A-15 Receive data virtual channel signals 





Signal Type Description 





RXDATFLITPEND Input Receive data flit pending 





RXDATFLITV Input Receive data flit valid 





RXDATFLIT[193:0] Input Receive data flit payload 





RXDATLCRDV Output Receive data link-layer credit valid 





A.9.8 System address map signals 


The following table shows the system address map signals for the CHI interface. The SAM signals are 
only sampled during powerup reset of the processor. 
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Table A-16 System address map signals 





Signal 


Type 


Description 





SAMMNBASE[43:24] 


Input 


MN base address. 





SAMADDRMAPO[1:0] 


Input 


0 to 512MB region mapping. 
Encoding for all SAMADDRMAPx{1:0] signals: 
e@bee HN-F. 


@be1 HN-I. 


@b10 Reserved. 
0b11 





SAMADDRMAPI1[1:0] 


Input 


512MB to 1GB region mapping. 





SAMADDRMAP?2[1:0] 


Input 


1GB to 1.5GB region mapping. 





SAMADDRMAP3[1:0] 


Input 


1.5GB to 2GB region mapping. 





SAMADDRMAP4[1:0] 


Input 


2GB to 2.5GB region mapping. 





SAMADDRMAP35[1:0] 


Input 


2.5GB to 3GB region mapping. 





SAMADDRMAP#6[1:0] 


Input 


3GB to 3.5GB region mapping. 





SAMADDRMAP?7[1:0] 


Input 


3.5GB to 4GB region mapping. 





SAMADDRMAP38[1:0] 


Input 


4GB to 8GB region mapping. 





SAMADDRMAP9[1:0] 


Input 


8GB to 16GB region mapping. 





SAMADDRMAP10[1:0] 


Input 


16GB to 32GB region mapping. 





SAMADDRMAP11[1:0] 


Input 


32GB to 64GB region mapping. 





SAMADDRMAP12[1:0] 


Input 


64GB to 128GB region mapping. 





SAMADDRMAP13[1:0] 


Input 


128GB to 256GB region mapping. 





SAMADDRMAP14[1:0] 


Input 


256GB to 512GB region mapping. 





SAMADDRMAPI15[1:0] 


Input 


512GB to 1TB region mapping. 





SAMADDRMAP16[1:0] 


Input 


1TB to 2TB region mapping. 





SAMADDRMAPI17{[1:0] 


Input 


2TB to 4TB region mapping. 





SAMADDRMAP18[1:0] 


Input 


4TB to 8TB region mapping. 








SAMADDRMAP19[1:0] 


Input 


8TB to 16TB region mapping. 





SAMMNNODEID[6:0] 


Input 


MN node ID. 





SAMHNIONODEID[6:0] 


Input 


HN-I 0 node ID. 





SAMHNIINODEID[6:0] 


Input 


HN-I 1 node ID. 





SAMHNFONODEID[6:0] 


Input 


HN-F 0 node ID. 





SAMHNF1NODEID[6:0] 


Input 


HN-F 1 node ID. 





SAMHNF2NODEID[6:0] 


Input 


HN-F 2 node ID. 





SAMHNF3NODEID[6:0] 


Input 


HN-F 3 node ID. 





SAMHNF4NODEID[6:0] 


Input 


HN-F 4 node ID. 














SAMHNFSNODEID[6:0] 


Input 








HN-F 5 node ID. 
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Table A-16 System address map signals (continued) 





Signal Type Description 





SAMHNF6NODEID[6:0] Input 


HN-F 6 node ID. 





SAMHNF7NODEID[6:0] Input 


HN-F 7 node ID. 





SAMHNFMODE/2:0] Input 


HN-F interleaving mode: 


ebeee 
@bee1 
@be10 
@b10e 


1 HN-F. 

2 HN-Fs. 
4 HN-Fs. 
8 HN-Fs. 


All other values are reserved. 
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This section shows the ACE interface signals. 


Note 





This interface only exists if the processor implements the ACE interface. 





This section contains the following subsections: 

e A.10.1 Clock and configuration signals on page Appx-A-548. 
¢ A.10.2 Write address channel signals on page Appx-A-548. 

¢ A.10.3 Write data channel signals on page Appx-A-549. 

e A.10.4 Write response channel signals on page Appx-A-549. 
¢ A.10.5 Read address channel signals on page Appx-A-550. 

¢ A.10.6 Read data channel signals on page Appx-A-550. 

e A.10.7 Snoop address channel signals on page Appx-A-551. 
¢ A.10.8 Snoop response channel signals on page Appx-A-551. 


e A.10.9 Snoop data channel handshake signals on page Appx-A-551. 
e A.10.10 Read/Write acknowledge signals on page Appx-A-552. 


A.10.1 Clock and configuration signals 


A Signal Descriptions 
A.10 ACE interface signals 


The following table shows the clock and configuration signals for the ACE interface. 


Table A-17 Clock and configuration signals 


Signal Type Description 





ACLKENM Input AXI master bus clock enable. 





ACINACTM Input Snoop interface is inactive. 


When this signal is HIGH, the snoop address channel stops accepting requests by deasserting ACREADYM. 


Snoop requests that were accepted before deasserting ACREADYM are serviced. 





Related information 
2.3 Clocking and resets on page 2-32. 


A.10.2 Write address channel signals 


The following table shows the write address channel signals for the ACE master interface. 


Table A-18 Write address channel signals 

















Signal Type Description 
AWREADYM Input Write address ready. 
AWVALIDM Output Write address valid. 
AWIDM[6:0] Output Write request ID. 
AWADDRM [43:0] Output Write address. 





AWLENMJ[7:0] Output 


Write burst length. AWLENM[7:2] is always 0b000000. 





AWSIZEM[2:0] Output 


Write burst size. 
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Table A-18 Write address channel signals (continued) 











Signal Type Description 
AWBURSTM[1:0] Output Write burst type. 
AWBARM([I1:0] Output Write barrier type. 





AWDOMAINM([1:0] Output 


Write shareability domain type. 





AWLOCKM Output 


Write lock type. 





AWCACHEM)]3:0] Output 


Write cache type. 





AWPROTM/2:0] Output 


Write protection type. 





AWSNOOPM[2:0] Output 


Write snoop request type. 





AWUNIQUEM Output 


Indicates the write operation for a WriteBack, WriteClean, or WriteEvict transaction is: 


0 Shared. 
1 Unique. 





WRMEMATTR{[7:0] Output 


Write request raw memory attributes: 

[7] Outer Shareable. 

[6:3] Outer memory attribute in MAIR format. 
[2] Inner Shareable. 


[1:0] bee Device. 
@be1 Normal Non-cacheable. 
@b10 Normal Write-Through. 
@b11 Normal Write-Back. 





A.10.3 Write data channel signals 


The following table shows the write data signals for the AXI master interface. 


Table A-19 Write data channel signals 














Signal Type Description 
WREADYM Input Write data ready 
WVALIDM Output Write data valid 
WIDM[6:0] Output Write data ID 





WDATAM[127:0] Output Write data 





WSTRBM[15:0] Output Write byte-lane strobes 





WLASTM Output Write data last transfer indication 





A.10.4 Write response channel signals 


The following table shows the write response channel signals for the ACE interface. 





fe 


Allocation hints based on outer memory attributes from the MMU. 
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Table A-20 Write response channel signals 





Signal Type 


Description 





BREADYM Output 


Write response ready 





BVALIDM Input 


Write response valid 





BIDM[6:0] Input 


Write response ID 





BRESPM{[1:0] Input 


Write response 





A.10.5 Read address channel signals 


The following table shows the read address channel signals for the ACE interface. 


Table A-21 Read address channel signals 












































Signal Type Description 

ARREADYM Input Read address ready. 

ARVALIDM Output Read address valid. 

ARIDM[6:0] Output Read request ID. 
ARADDRM[43:0] Output Read address. 

ARLENM[7:0] Output Read burst length. ARLENM[7:2] is always @b000000. 
ARSIZEM[2:0] Output Read burst size. 

ARBURSTM[1:0] Output Burst type. 

ARBARM{[1:0] Output Read barrier type. 
ARDOMAINM[1:0] Output Read shareability domain type. 
ARLOCKM Output Read lock type. 

ARCACHEM[3:0] Output Read cache type. 
ARPROTM[2:0] Output Read protection type. 
ARSNOOPM[3:0] Output Read snoop request type. 
RDMEMATTRI7:0] Output Read request raw memory attributes: 


[7] Outer Shareable. 
[6:3] Outer memory attribute in MAIR format. 
[2] Inner Shareable. 


[1:0] bee Device. 
@be1 Normal Non-cacheable. 
0b10 Normal Write-Through. 
@b11 Normal Write-Back. 





A.10.6 Read data channel signals 


The following table shows the read data channel signals for the ACE interface. 





ff 


Allocation hints based on outer memory attributes from the MMU. 
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Table A-22 Read data channel signals 














Signal Type Description 
RREADYM Output Read data ready 
RVALIDM Input Read data valid 
RIDM[6:0] Input Read data ID 





RDATAM[127:0] Input Read data 





RRESPM/[3:0] Input Read data response 





RLASTM Input Read data last transfer indication 





A.10.7 Snoop address channel signals 


The following table shows the snoop address channel signals for the ACE interface. 


Table A-23 Snoop address channel signals 





Signal Type Description 





ACREADYM Output Master ready to receive snoop address 





ACVALIDM Input Snoop address valid 





ACADDRM[43:0] Input Snoop address 





ACPROTM[2:0] Input Snoop protection type 





ACSNOOPM/[3:0] Input Snoop request type 





A.10.8 Snoop response channel signals 


The following table shows the snoop response channel signals for the AXI master interface. 


Table A-24 Snoop response channel signals 





Signal Type Description 





CRREADYM Input Slave ready to accept snoop response 





CRVALIDM Output Snoop response valid 





CRRESPM[4:0] Output Snoop response 





A.10.9 Snoop data channel handshake signals 


The following table shows the snoop data channel handshake signals for the ACE interface. 


Table A-25 Snoop data channel handshake signals 














Signal Type Description 
CDREADYM Input Slave ready to accept snoop data 
CDVALIDM Output Snoop data valid 
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Table A-25 Snoop data channel handshake signals (continued) 





Signal Type Description 





CDDATAM[127:0] Output Snoop data 





CDLASTM Output Snoop data last transfer indication 





A.10.10 Read/Write acknowledge signals 


The following table shows the read/write acknowledge signals for the AXI master interface. 


Table A-26 Read/write acknowledge signals 





Signal Type Description 





RACKM Output Read acknowledge 





WACKM Output Write acknowledge 
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A.11 ACP interface signals 


Describes the ACP interface signals. 


Note 


These signals only exist if the processor is configured to have an ACP interface. 








This section contains the following subsections: 

¢ A.11.1 Clock and configuration signals on page Appx-A-553. 
¢ A.11.2 Write address channel signals on page Appx-A-553. 

¢ A.11.3 Write data channel signals on page Appx-A-554. 

e A.11.4 Write response channel signals on page Appx-A-554. 
¢ A.11.5 Read address channel signals on page Appx-A-555. 

e A.11.6 Read data channel signals on page Appx-A-555. 


A.11.1 Clock and configuration signals 


The following table shows the clock and configuration signals for the ACP interface. 


Table A-27 Clock and configuration signals 


Signal Type Description 





ACLKENS Input ACP clock enable. 





AINACTS Input ACP inactive control. When this signal is HIGH, the ACP stops accepting requests by deasserting ARREADYS 
and AWREADYS. When AINACTS is asserted, the SoC must not assert ARVALIDS, AWVALIDS, or 
WVALIDS. 





Related information 
2.3.1 Clocks on page 2-32. 
2.4.1 Dynamic power management on page 2-42. 


A.11.2 Write address channel signals 


The following table shows the write address channel signals for the ACP interface. 


Table A-28 Write address channel signals 














Signal Type Description 
AWREADYS Output Write address ready. 
AWVALIDS Input Write address valid. 
AWIDS [4:0] Input Write request ID. 





AWADDRS[43:0] Input Write address. 





AWLENS[7:0] Input Write burst length. 





AWCACHESJ[3:0] Input Write cache type. 
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Table A-28 Write address channel signals (continued) 





Signal Type Description 





AWUSERS[1:0] Input Write attributes: 


[1] Outer Shareable. 
[0] Inner Shareable. 





AWPROTS[2:0] Input Write protection type. 





Note 
The ACP interface uses the AXI4 defined default values for the following input signals: 
b100 AWSIZES[2:0]. 
@be1 AWBURSTS[1:0]. 
@be AWLOCKS. 





Related information 
7.8.2 ACP ARUSER and AWUSER signals on page 7-317. 


A.11.3 Write data channel signals 


The following table shows the write data channel signals for the ACP interface. 


Table A-29 Write data channel signals 











Signal Type Description 
WREADYS Output Write data ready 
WVALIDS Input Write data valid 





WDATAS[127:0] Input Write data 





WSTRBS[15:0] Input Write byte-lane strobes 





WLASTS Input Write data last transfer indication 





A.11.4 Write response channel signals 


The following table shows the write response channel signals for the ACP interface. 


Table A-30 Write response channel signals 





Signal Type Description 





BREADYS Input Write response ready 





BVALIDS Output Write response valid 





BIDS[4:0] Output Write response ID 





BRESPS[1:0] Output Write response 
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A.11.5 Read address channel signals 
The following table shows the read address channel signals for the ACP interface. 
Table A-31 Read address channel signals 

Signal Type Description 
ARREADYS Output Read address ready. 
ARVALIDS Input Read address valid. 
ARIDS[4:0] Input Read request ID. 
ARADDRS[43:0] Input Read address. 
ARLENS[7:0] Input Read burst length. 
ARCACHES[3:0] Input Read cache type. 
ARUSERS[1:0] Input Read attributes: 

[1] Outer Shareable. 

[0] Inner Shareable. 
ARPROTS[2:0] Input Read protection type. 

Note 


The ACP interface uses the AXI4 defined default values for the following input signals: 


0b100 
@be1 
@be 


ARSIZES[2:0]. 
ARBURSTS[1:0]. 


ARLOCKS. 





Related information 
7.8.2 ACP ARUSER and AWUSER signals on page 7-317. 


A.11.6 


Read data channel signals 


The following table shows the read data channel signals for the ACP interface. 


Table A-32 Read data channel signals 























Signal Type Description 

RREADYS Input Read data ready 

RVALIDS Output Read data valid 

RIDS[4:0] Output Read data ID 

RDATAS[127:0] Output Read data 

RRESPS[1:0] Output Read data response 

RLASTS Output Read data last transfer indication 








ARM 100095_0003_05_en 


Copyright © 2014-2016 ARM. All rights reserved. 
Non-Confidential 


Appx-A-555 


A Signal Descriptions 
A.12 Debug interface signals 


A.12 Debug interface signals 
Describes the external debug interface signals. 


This section contains the following subsections: 

e A.12.1 APB interface signals on page Appx-A-556. 

e A.12.2 Authentication interface signals on page Appx-A-556. 
e A.12.3 Miscellaneous debug signals on page Appx-A-557. 


A.12.1 APB interface signals 
The following table shows the APB interface signals. 


Table A-33 APB interface signals 














Signal Type Description 
PCLKDBG Input APB clock. 
PCLKENDBG Input APB clock enable. 
nPRESETDBG Input Active-LOW APB reset: 
0 Reset APB. 
1 Do not reset APB. 
PSELDBG Input Debug registers select: 
0 Debug registers not selected. 
1 Debug registers selected. 





PADDRDBG[21:2] Input APB address bus bits[21:2]. 











PADDRDBG31 Input APB address bus bit[31]: 

0 Not an external debugger access. 

1 External debugger access. 
PENABLEDBG Input Indicates the second and subsequent cycles of an APB transfer. 
PWRITEDBG Input APB read or write signal: 

0 Reads from APB. 

1 Writes to APB. 





PWDATADBGJ[31:0] Input APB write data bus. 





PRDATADBG [31:0] Output APB read data bus. 








PREADYDBG Output APB slave ready. An APB slave can assert PREADYDBG to extend a transfer by inserting wait 
States. 

PSLVERRDBG Output APB slave transfer error: 
0 No transfer error. 
1 Transfer error. 





A.12.2 Authentication interface signals 


The following table shows the authentication interface signals. 
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Table A-34 Authentication interface signals 





Signal Type Description 





DBGEN|[N:0] Input Invasive debug enable: 


0 Not enabled. 
1 Enabled. 





NIDEN[N:0] Input Non-invasive debug enable: 


0 Not enabled. 
1 Enabled. 





SPIDEN[N:0] Input Secure privileged invasive debug enable: 


0 Not enabled. 
1 Enabled. 





SPNIDEN[N:0] Input Secure privileged non-invasive debug enable: 


0 Not enabled. 
1 Enabled. 





A.12.3 Miscellaneous debug signals 


The following table shows the miscellaneous debug signals. 


Table A-35 Miscellaneous debug signals 





Signal Type Description 





DBGROMADDR{[43:12] Input Specifies bits[43:12] of the top-level ROM table Physical Address. 
If the address cannot be determined, tie this signal LOW. 


This signal is only sampled during powerup reset of the processor. 





DBGROMADDRV Input Valid signal for DBGROMADDR. 
If the address cannot be determined, tie this signal LOW. 


This signal is only sampled during powerup reset of the processor. 








DBGACK[N:0] Output Debug acknowledge: 
0 Debug not acknowledged. 
1 Debug acknowledged. 
nCOMMIRQ[N:0] Output Communications channel receive or transmit interrupt request, active LOW: 


0 Receive section data transfer register is full or transmit section data transfer register is empty. 


1 Either or both: 


e The receive section data transfer register is empty. 
¢ The transmit section data transfer register is empty. 











COMMRX|[N:0] Output Communications channel receive. Receive portion of Data Transfer Register full flag: 
0 Empty. 
1 Full. 
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Table A-35 Miscellaneous debug signals (continued) 





Signal 


Type 


Description 





COMMTX(N:0] 


Output 


Communication channel transmit. Transmit portion of Data Transfer Register empty flag: 


0 Full. 
1 Empty. 





EDBGRQ[N:0] 


Input 


External debug request: 


0 No external debug request. 


1 External debug request. 


The processor treats the EDBGRQ input as level-sensitive. The EDBGRQ input must be asserted 
until the processor asserts DBGACK. 





DBGRSTREQIN:0] 


Output 


Warm reset request: 
0 Warm reset is not requested. 


1 Request Warm reset. 


This output is controlled by Warm reset request bit in External Debug Power/Reset Control 
Register, EDPRCR. 





DBGNOPWRDWN|[N:0] 


Output 


No powerdown request. On a powerdown request: 


0 The SoC power controller powers down the processor. 


1 The SoC power controller does not power down the processor. 





DBGPWRDUP[N:0] 


Input 


Processor power status: 


0 Processor is not powered up. 


1 Processor is powered up. 





DBGPWRUPREQJN:0] 


Output 


Processor powerup request: 


0 No request for processor power up. 


1 Request for processor power up. 





DBGLIRSTDISABLE 


Input 


Disable L1 data cache and L2 snoop tag RAM automatic invalidate on reset functionality. 


0 Enable automatic invalidation of L1 data cache and L2 snoop tag RAMs on reset. 


1 Disable automatic invalidation of L1 data cache and L2 snoop tag RAMs on reset 


This signal is sampled only during reset of the processor. 





Related information 
WARMRSTREO and DBGRSTREQ on page 2-40. 
External debug over powerdown on page 2-57. 
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A.13 ETM interface 
Describes the ETM interface. 
This section contains the following subsections: 
e A.13.1 ATB interface on page Appx-A-559. 
e A.13.2 Miscellaneous ETM signal on page Appx-A-559. 
A.13.1 ATB interface 
The following table shows the signals of the ATB interface. 
Table A-36 ATB interface signals 
Signal Type Description 
ATCLKEN Input ATB clock enable 
ATREADYMx Input ATB device ready: 
0 Not ready. 
1 Ready. 
AFVALIDMx Input FIFO flush request. 
ATDATAMx{[31:0] Output ATB data bus. 
ATVALIDMx Output ATB valid data: 
0 No valid data. 
1 Valid data. 
ATBYTESMx{[1:0] Output CoreSight ATB device data size: 
ebee 1 byte. 
@be1 2 byte. 
@b10 3 byte. 
@b11 4 byte. 
AFREADYMx Output FIFO flush acknowledge: 
0 FIFO flush not complete. 
1 FIFO flush complete. 
ATIDMx{[6:0] Output ATB trace source identification. 
SYNCREQMx Input Synchronization request. 
The input must be driven HIGH for one ATCLK cycle. 
A.13.2 Miscellaneous ETM signal 


The following table shows the miscellaneous ETM interface signal. 
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Table A-37 Miscellaneous ETM interface signal 





Signal Type Description 





TSVALUEB[63:0] Input Global system timestamp value in binary format 
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A.14 Cross trigger channel interface 


The following table shows the cross trigger channel interface signals. 


Table A-38 Cross trigger channel interface signals 





Signal Type Description 





CIHSBYPASS[3:0] Input Cross trigger channel interface handshake bypass. 








CISBYPASS Input Cross trigger channel interface sync bypass. 

CTICHIN[3:0] Input Cross trigger channel input. Each bit represents a valid channel input: 
0 Channel input inactive. 
1 Channel input active. 





CTICHINACK{[3:0] Output Cross trigger channel input acknowledge. 





CTICHOUT{[3:0] Output Cross trigger channel output. Each bit represents a valid channel output: 
0 Channel output inactive. 
1 Channel output active. 





CTICHOUTACK[3:0] Input Cross trigger channel output acknowledge. 





CTITRQ[N:0] Output Active-HIGH cross trigger interrupt output: 
0 Interrupt not active. 
1 Interrupt active. 





CTITRQACK[N:0] Input Cross trigger interrupt acknowledge. 
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A.15 PMU signals 


The following table shows the performance monitoring signals. 


Table A-39 Performance monitoring signals 











Signal Type Description 
nPMUIRQ[N:0] Output PMU interrupt signal 
PMUEVENTx[24:0] Output PMU event bus 





PMUSNAPSHOTREQ[N:0] Input PMU snapshot trigger request 





PMUSNAPSHOTACK[N:0] Output PMU snapshot trigger acknowledge 





Related information 
11.8 Events on page 11-428. 
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A.16 DFT and MBIST signals 
Describes the DFT and MBIST signals. 


This section contains the following subsections: 
e A.16.1 DFT signals on page Appx-A-563. 
e A.16.2 MBIST interface on page Appx-A-563. 


A.16.1 DFT signals 


The following table shows the DFT interface signals. 


Signal 


Type 


Table A-40 DFT interface signals 


Description 





DFTCLKBYPASS 


Input 


Bypasses the strobe clock register to the L2 RAMs, forcing the L2 RAMs to be tested using 
CLK as the source clock 




















DFTCRCLKDISABLE[N:0] Input Disables processor clock grid 

DFTL2CLKDISABLE Input Disables L2 clock grid 

DFTMCPHOLD Input Disables multi-cycle paths on RAM interfaces 
DFTRAMHOLD Input Disables the RAM chip selects during scan shift 
DFTRSTDISABLE Input Disables internal synchronized reset during scan shift 
DFTSE Input Scan shift enable, forces on the clock grids during scan shift 





A.16.2 MBIST interface 


The following table shows the Memory Built-In Self Test (MBIST) interface signals. 


Table A-41 MBIST interface signals 





Signal Type Description 





nMBISTRESET Input MBIST reset 





MBISTREQ Input MBIST test request 
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This appendix describes specific Cortex-A72 processor UNPREDICTABLE behaviors that are of particular 
interest. 


It contains the following sections: 
e B.1 Unpredictable behaviors on page Appx-B-565. 
e B.2 Debug UNPREDICTABLE behaviors on page Appx-B-567. 
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B.1 Unpredictable behaviors 


The following sections describe how the Cortex-A72 processor implementation differs from the 
preferred AArch32 UNPREDICTABLE behaviors. 


This section contains the following subsections: 
e B11 Use of R15 by instruction on page Appx-B-565. 
¢ B.1.2 Load or store accesses that span a page boundary on page Appx-B-566. 


B.1.1 Use of R15 by instruction 


The Cortex-A72 processor does not implement a Read 0 policy on UNPREDICTABLE use of R15 by 
instruction. Instead, the processor reads the PC with the standard offset that applies for the current 
instruction set with alignment to a word boundary. 


Word-alignment of the PC is imposed for all T32 instructions that are either: 


¢ Defined as loads in the definition of PMU event 0x70. 
e Defined as stores in the definition of PMU event 0x71. 


With the notable exceptions to this alignment policy that: 

e The PC value for TBB and TBH instructions is explicitly not forced to a word-aligned value. TBB and 
TBH are technically PMU loads but for the processor to comply with the architecture, it cannot force 
the PC to a word-aligned value for these instructions. 

e The PC value for ADR instructions is explicitly forced to a word-aligned value. ADR is not a PMU load 
or a PMU store, but the architecture specifies word-aligned PC for ADR instructions. 
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B.1.2 Load or store accesses that span a page boundary 


This section describes load or store accesses that cross page boundaries. 


The behavior of the Cortex-A72 processor is as follows: 
e Store crosses a page boundary: 
— The processor performs two stores, one to each page. The stores behave according to the 
attributes of the page that each store hits. 
e Load crosses a page boundary: 


Device to Device, Normal to Normal 
The processor performs two loads, one from each page. The loads behave according to the 
attributes of the page that each load hits. 

Device to Normal, Normal to Device 
The processor generates an Alignment fault. 
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B.2 Debug unprepictaste behaviors 


This section describes the behavior that the Cortex-A72 processor implements when: 


A topic has multiple options. 
The behavior differs from either or both of the Options and Preferences behaviors. 


Note 





This section does not describe the behavior when a topic only has a single option and the processor 
implements the preferred behavior. 





This section contains the following subsections: 


B.2.1 A32 BKPT instruction with condition code not AL on page Appx-B-568. 

B.2.2 Address match breakpoint match only on second halfword of an instruction 

on page Appx-B-568. 

B.2.3 Address matching breakpoint on A32 instruction with DBGBCRn.BAS=1100 

on page Appx-B-568. 

B.2.4 Address match breakpoint match on T32 instruction at DBGBCRn+2 with 
DBGBCRn.BAS=1111 on page Appx-B-568. 

B.2.5 Address mismatch breakpoint match only on second halfword of an instruction 

on page Appx-B-568. 

B.2.6 Address mismatch breakpoint match on T32 instruction at DBGBCRn+2 with 
DBGBCRn.BAS=1111 on page Appx-B-568. 

B.2.7 Other mismatch breakpoint matches any address in current mode and state 

on page Appx-B-569. 

B.2.8 Mismatch breakpoint on branch to self on page Appx-B-569. 

B.2.9 Link to nonexistent breakpoint or breakpoint that is not context-aware on page Appx-B-569. 
B.2.10 DBGWCRn_EL1.MASK!=00000 and DBGWCRn_EL1.BAS!=11111111 

on page Appx-B-569. 

B.2.11 Address-matching Vector catch on 32-bit T32 instruction at vector—2 on page Appx-B-569. 
B.2.12 Address-matching Vector catch on 32-bit T32 instruction at vector+2 on page Appx-B-569. 
B.2.13 Address-matching Vector catch and Breakpoint on same instruction on page Appx-B-569. 
B.2.14 Address match breakpoint with DBGBCRn_EL1.BAS=0000 on page Appx-B-569. 

B.2.15 DBGWCRn_EL1.BAS specifies a non-contiguous set of bytes within a doubleword 

on page Appx-B-569. 

B.2.16 A32 HLT instruction with condition code not AL on page Appx-B-570. 

B.2.17 Execute instruction at a given EL when the corresponding EDECCR bit is 1] and Halting is 
allowed on page Appx-B-570. 

B.2.18 Unlinked Context matching and Address mismatch breakpoints taken to Abort mode 

on page Appx-B-570. 

B.2.19 Vector catch on Data or Prefetch Abort, and taken to Abort mode on page Appx-B-570. 
B.2.20 H > N or H = 0 at Non-secure EL1 and ELO, including value read from PMCR_ELO.N 

on page Appx-B-571. 

B.2.21 H > Nor H = 0: value read back in MDCR_EL2.HPMN on page Appx-B-571. 

B.2.22 P > Mand P # 31: reads and writes of PAXEVTYPER_ELO and PMXEVCNTR_ELO 

on page Appx-B-571. 

B.2.23 P > M and P £ 31: value read in PMSELR_ELO.SEL on page Appx-B-571. 

B.2.24 P = 31: reads and writes of PAXEVCNTR_ELO on page Appx-B-571. 

B.2.25 n > M: Direct access to PMEVCNTRn_ELO and PMEVTYPERn_ELO on page Appx-B-571. 
B.2.26 Exiting Debug state while instruction issued through EDITR is in flight 

on page Appx-B-572. 

B.2.27 Using memory-access mode with a non-word-aligned address on page Appx-B-572. 
B.2.28 Access to memory-mapped registers mapped to Normal memory on page Appx-B-572. 
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¢ B.2.29 Not word-sized accesses or (AArch64 only) doubleword-sized accesses 
on page Appx-B-572. 

¢ B.2.30 External debug write to register that is being reset on page Appx-B-572. 

¢ B.2.31 Accessing reserved debug registers on page Appx-B-572. 

e B.2.32 Clearing the clear-after-read EDPRSR bits when Core power domain is on, and 
DoubleLockStatus() is TRUE on page Appx-B-573. 





B.2.1 A32 BKPT instruction with condition code not AL 
The processor implements the preferred option, that is: 
e Executed unconditionally. 
B.2.2 Address match breakpoint match only on second halfword of an instruction 
The processor generates a breakpoint on the instruction, unless it is a breakpoint on the second half of the 
first 32-bit instruction in an aligned 128-bit region or following a taken branch. In this case the 
breakpoint is taken on the following instruction. 
B.2.3 Address matching breakpoint on A32 instruction with DBGBCRn.BAS=1100 
An address match occurs, unless the instruction is the first instruction within an instruction fetch, that is 
the first instruction in a 128-bit aligned region for a sequential fetch, or first instruction following a taken 
branch. In this case the breakpoint is taken on the following instruction. 
B.2.4 Address match breakpoint match on T32 instruction at DBGBCRn+2 with 
DBGBCRn.BAS=1111 
The processor implements: 
e Does match. 
B.2.5 Address mismatch breakpoint match only on second halfword of an instruction 
The processor implements: 
e Does match. 
B.2.6 Address mismatch breakpoint match on T32 instruction at DBGBCRn+2 with 
DBGBCRn.BAS=1111 
The processor behaves as follows: 
¢ If BVRn+2 is directly jumped to, then the breakpoint is taken on the instruction following BVRn+2. 
The instruction is stepped. 
¢ IfBVRn precedes a 16-bit instruction, then the breakpoint is taken on the instruction at DBGBVRn 
+2; 
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B.2.7 Other mismatch breakpoint matches any address in current mode and state 
The processor implements: 
e Immediate Breakpoint debug event. 
B.2.8 Mismatch breakpoint on branch to self 
The processor implements: 
e Instruction is stepped an UNKNOWN number of times, while it continues to branch to itself. 
B.2.9 Link to nonexistent breakpoint or breakpoint that is not context-aware 
The processor implements: 
e No Breakpoint or Watchpoint debug event is generated, and the LBN field of the linker reads 
UNKNOWN. 
B.2.10 DBGWCRn_EL1.MASK!=00000 and DBGWCRn_EL1.BAS!=11111111 
The processor implements the preferred behavior: 
e DBGWCRn_EL1.BAS is ignored and treated as if @b11111111. 
B.2.11 Address-matching Vector catch on 32-bit T32 instruction at vector—2 
The processor implements: 
e Does match, unless it is the first instruction following a discontinuity, a branch, in which case it 
matches on the following instruction. 
B.2.12 Address-matching Vector catch on 32-bit T32 instruction at vector+2 
The processor implements: 
e Does match, unless it is the first instruction following a discontinuity, a branch, in which case it 
matches on the following instruction. 
B.2.13 Address-matching Vector catch and Breakpoint on same instruction 
The processor implements the preferred option, that is: 
e Report Breakpoint. 
B.2.14 Address match breakpoint with DBGBCRn_EL1.BAS=0000 
The processor implements the preferred option, that is: 
e As if disabled. 
B.2.15 DBGWCRn_EL1.BAS specifies a non-contiguous set of bytes within a doubleword 
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B AArch32 Unpredictable Behaviors 
B.2 Debug UNPREDICTABLE behaviors 


The processor behaves as follows: 


e A Watchpoint debug event is generated for each byte. 


B.2.16 A32 HLT instruction with condition code not AL 


The processor implements the preferred option, that is: 
e Executed unconditionally. 


B.2.17 Execute instruction at a given EL when the corresponding EDECCR bit is 1 and Halting is 
allowed 


The processor behaves as follows: 


e Generates debug event and Halt no later than the instruction following the next Context 
Synchronization operation (CSO) excluding ISB instruction. 


B.2.18 Unlinked Context matching and Address mismatch breakpoints taken to Abort mode 


The processor implements: 
e A Prefetch Abort debug exception is generated. Because the breakpoint is configured to generate a 


breakpoint at PL1, the instruction at the Prefetch Abort vector generates a Vector catch debug event. 
Note 


The debug event is subject to the same CONSTRAINED UNPREDICTABLE behavior, so the Breakpoint debug 
event repeats for an UNKNOWN number of times. 








B.2.19 Vector catch on Data or Prefetch Abort, and taken to Abort mode 


The processor implements: 
e A Prefetch Abort debug exception is generated. If Vector catch is enabled on the Prefetch Abort 


vector, this generates a Vector catch debug event. 
Note 


The debug event is subject to the same CONSTRAINED UNPREDICTABLE behavior, so the Vector catch debug 
event repeats for an UNKNOWN number of times. 
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B.2.20 


B.2.21 


B.2.22 


B.2.23 


B.2.24 


B.2.25 


B AArch32 Unpredictable Behaviors 
B.2 Debug UNPREDICTABLE behaviors 


H > N or H = 0 at Non-secure EL1 and ELO, including value read from PMCR_ELO.N 


The processor implements: 

e HPMN/[4:0], and in Non-secure EL1 and ELO: 
— IfH>N then MEN. 
— IfH=0 then M =0. 


H > N or H = 0: value read back in MDCR_EL2.HPMN 


The processor implements: 
e HPMN/[4:0], and reads return H. 


P 2 M and P # 31: reads and writes of PMXEVTYPER_ELO and PMXEVCNTR_ELO 


The processor implements: 
e SEL[4:0], and if P > M and P 31 then the register is REso. 


P 2 M and P # 31: value read in PMSELR_ELO.SEL 


The processor implements: 
e SEL[4:0], and if P > M and P £ 31 then the register is REso. 


P = 31: reads and writes of PMXEVCNTR_ELO 


The processor implements: 
e The register is RESO. 


n 2M: Direct access to PMEVCNTRn_EL0O and PMEVTYPERn_ELO 


The processor implements: 


e Ifn>N then the instruction is UNALLOCATED. 
e Otherwise ifn > M then the register is RESo. 
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B AArch32 Unpredictable Behaviors 
B.2 Debug UNPREDICTABLE behaviors 





B.2.26 Exiting Debug state while instruction issued through EDITR is in flight 

The processor implements: 

¢ The instruction completes in Debug state before executing the restart. 
B.2.27 Using memory-access mode with a non-word-aligned address 

The processor implements the preferred behavior, that is: 

e Does unaligned accesses, faulting if these are not permitted for the memory type. 
B.2.28 Access to memory-mapped registers mapped to Normal memory 

The processor implements the preferred behavior, that is: 

e The access is generated, and accesses might be repeated, gathered, split or resized, in accordance with 
the rules for Normal memory, meaning the effect is UNPREDICTABLE. 

B.2.29 Not word-sized accesses or (AArch64 only) doubleword-sized accesses 

The processor implements the preferred behavior, that is: 

e Reads occur and return UNKNOWN data. 

e Writes set the accessed registers to UNKNOWN. 

B.2.30 External debug write to register that is being reset 

The processor implements the preferred behavior, that is: 

e Takes reset value. 

B.2.31 Accessing reserved debug registers 

The processor deviates from the preferred behavior because the hardware cost to decode some of the 

addresses in the debug power domain is significant. 

The processor behavior is: 

1. For reserved debug registers 0x000 - @xCFC and reserved Performance Monitors registers 0x000 - 
@xF@@, the response is CONSTRAINED UNPREDICTABLE Error, when any of the following apply: 

Off Core power domain is either completely off, or in a low-power state where the Core power 
domain registers are not accessible. 

DLK _ DoubleLockStatus() is TRUE, OS double-lock is locked, that is, EDPRSR.DLK is 1. 

OSLK OSLSR_EL1.OSLK is 1, OS Lock is locked. 

2. For reserved debug registers in the address ranges 0x400 - @x4FC and 0x800 - @x8FC, the response is 
CONSTRAINED UNPREDICTABLE Error when the conditions in / do not apply and: 

EDAD AllowExternalDebugAccess() is FALSE, external debug access is disabled. 

3. For reserved Performance Monitor registers in the address ranges 0x000 - @x@FC and 0x400 - @x47C, 
the response is CONSTRAINED UNPREDICTABLE Error when the conditions in / and 2 do not apply but the 
following condition applies: 

EPMAD AllowExternalPMUAccess() is FALSE (external Performance Monitors access is 
disabled). 
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B AArch32 Unpredictable Behaviors 
B.2 Debug UNPREDICTABLE behaviors 


B.2.32 Clearing the clear-after-read EDPRSR bits when Core power domain is on, and 
DoubleLockStatus() is TRUE 


The processor implements the preferred behavior, that is: 
e Bits are not cleared to zero. 
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Appendix C 
Revisions 


This appendix describes the technical changes between released issues of this book. 


It contains the following sections: 
e Cl Revisions on page Appx-C-575. 
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C Revisions 
C.1 Revisions 




































































C.1 Revisions 
Table C-1 Issue 01 
Change Location Affects 
First release - = 
Table C-2 Issue 02 
Change Location Affects 
Updated for support of 4MB L2 cache size Throughout document r0p1 
Added configuration options for up to two L2 Data RAM slices Throughout document r0pl 
L1 hardware prefetcher terminology clarified to load-store hardware prefetcher Throughout document r0p1 
Updated Main ID Register Value (MIDR) Throughout document r0pl 
Table C-3 Issue 03 
Change Location Affects 
Updated bit [23] of L2 Auxiliary Control Register, EL1 4.3.65 L2 Auxiliary Control Register, EL1 on page 4-188 — r0p2 
Updated bit [41] of CPU Auxiliary Control Register, EL1 4.3.66 CPU Auxiliary Control Register, EL] on page 4-194 r0p2 
Table C-4 Issue 04 
Change Location Affects 
Updated bits to write to disable L2 prefetch * Individual core powerdown on page 2-52 r0p2 
e L2 hardware cache flush on page 2-45 
Updated Main ID Register Value (MIDR) Throughout document r0p2 
Table C-5 Issue 05 
Change Location Affects 
Updated Main ID Register Value (MIDR) Throughout document r0p3 
Updated Trace ID Revision Value Throughout document r0p3 
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